dcrat | cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe
Size

1.3MB
MD5

c6491a01b766a43d2d5e509530676759
SHA1

cee71541c5fa6b59e0297ff77f4cd457d9909b0e
SHA256

cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b
SHA512

ca9bc13df391f24fd6e677e75e8585222a7a3d797f7c8941eb89c259dc5ff694879fce12857d7a04f2279af5060e2aaae2412eccb6ba14a94bcf4ac29e2f0da5
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	1944	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	1944	schtasks.exe	40

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e46-137.dat	dcrat
behavioral1/files/0x0006000000022e46-138.dat	dcrat
behavioral1/memory/4776-139-0x00000000000D0000-0x00000000001E0000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e59-223.dat	dcrat
behavioral1/files/0x0006000000022e59-224.dat	dcrat
behavioral1/files/0x0006000000022e59-231.dat	dcrat
behavioral1/files/0x0006000000022e59-239.dat	dcrat
behavioral1/files/0x0006000000022e59-246.dat	dcrat
behavioral1/files/0x0006000000022e59-253.dat	dcrat
behavioral1/files/0x0006000000022e59-260.dat	dcrat
behavioral1/files/0x0006000000022e59-267.dat	dcrat
behavioral1/files/0x0006000000022e59-274.dat	dcrat
behavioral1/files/0x0006000000022e59-281.dat	dcrat

Executes dropped EXE 10 IoCs

pid	Process
4776	DllCommonsvc.exe
5996	taskhostw.exe
5008	taskhostw.exe
2044	taskhostw.exe
5768	taskhostw.exe
5128	taskhostw.exe
3960	taskhostw.exe
2176	taskhostw.exe
5880	taskhostw.exe
5528	taskhostw.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\migwiz\de-DE\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\System32\migwiz\de-DE\cc11b995f2a76d	DllCommonsvc.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\Resources\fr-FR\fontdrvhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
824	schtasks.exe
2744	schtasks.exe
4268	schtasks.exe
3284	schtasks.exe
3832	schtasks.exe
944	schtasks.exe
1404	schtasks.exe
4940	schtasks.exe
1664	schtasks.exe
444	schtasks.exe
4904	schtasks.exe
3620	schtasks.exe
3712	schtasks.exe
2484	schtasks.exe
4892	schtasks.exe
2540	schtasks.exe
3136	schtasks.exe
1532	schtasks.exe
1692	schtasks.exe
4020	schtasks.exe
480	schtasks.exe
2876	schtasks.exe
3396	schtasks.exe
3684	schtasks.exe
2316	schtasks.exe
3552	schtasks.exe
4396	schtasks.exe
3976	schtasks.exe
1248	schtasks.exe
2748	schtasks.exe
2736	schtasks.exe
3636	schtasks.exe
1084	schtasks.exe
4232	schtasks.exe
3708	schtasks.exe
4372	schtasks.exe
4604	schtasks.exe
544	schtasks.exe
1656	schtasks.exe
3672	schtasks.exe
2140	schtasks.exe
228	schtasks.exe
1592	schtasks.exe
2436	schtasks.exe
4652	schtasks.exe
4612	schtasks.exe
488	schtasks.exe
3428	schtasks.exe
2740	schtasks.exe
1540	schtasks.exe
216	schtasks.exe
3196	schtasks.exe
2272	schtasks.exe
3040	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	taskhostw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4776	DllCommonsvc.exe
4280	powershell.exe
4280	powershell.exe
4596	powershell.exe
4596	powershell.exe
2368	powershell.exe
3336	powershell.exe
2368	powershell.exe
3336	powershell.exe
2308	powershell.exe
2308	powershell.exe
3796	powershell.exe
3796	powershell.exe
3756	powershell.exe
3756	powershell.exe
4868	powershell.exe
4868	powershell.exe
4544	powershell.exe
4544	powershell.exe
1500	powershell.exe
1500	powershell.exe
3936	powershell.exe
3936	powershell.exe
3524	powershell.exe
3524	powershell.exe
1532	powershell.exe
1532	powershell.exe
1412	powershell.exe
1412	powershell.exe
3208	powershell.exe
3208	powershell.exe
5036	powershell.exe
5036	powershell.exe
2700	powershell.exe
2700	powershell.exe
4976	powershell.exe
4976	powershell.exe
4496	powershell.exe
4496	powershell.exe
5036	powershell.exe
4596	powershell.exe
4596	powershell.exe
2368	powershell.exe
2368	powershell.exe
4280	powershell.exe
4280	powershell.exe
3336	powershell.exe
3336	powershell.exe
2308	powershell.exe
2308	powershell.exe
3796	powershell.exe
3796	powershell.exe
3756	powershell.exe
3756	powershell.exe
4976	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	DllCommonsvc.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	5996	taskhostw.exe
Token: SeDebugPrivilege	5008	taskhostw.exe
Token: SeDebugPrivilege	2044	taskhostw.exe
Token: SeDebugPrivilege	5768	taskhostw.exe
Token: SeDebugPrivilege	5128	taskhostw.exe
Token: SeDebugPrivilege	3960	taskhostw.exe
Token: SeDebugPrivilege	2176	taskhostw.exe
Token: SeDebugPrivilege	5880	taskhostw.exe
Token: SeDebugPrivilege	5528	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1068	3524	cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe	79
PID 3524 wrote to memory of 1068	3524	cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe	79
PID 3524 wrote to memory of 1068	3524	cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe	79
PID 1068 wrote to memory of 4848	1068	WScript.exe	83
PID 1068 wrote to memory of 4848	1068	WScript.exe	83
PID 1068 wrote to memory of 4848	1068	WScript.exe	83
PID 4848 wrote to memory of 4776	4848	cmd.exe	85
PID 4848 wrote to memory of 4776	4848	cmd.exe	85
PID 4776 wrote to memory of 4280	4776	DllCommonsvc.exe	141
PID 4776 wrote to memory of 4280	4776	DllCommonsvc.exe	141
PID 4776 wrote to memory of 3336	4776	DllCommonsvc.exe	142
PID 4776 wrote to memory of 3336	4776	DllCommonsvc.exe	142
PID 4776 wrote to memory of 2368	4776	DllCommonsvc.exe	143
PID 4776 wrote to memory of 2368	4776	DllCommonsvc.exe	143
PID 4776 wrote to memory of 4596	4776	DllCommonsvc.exe	146
PID 4776 wrote to memory of 4596	4776	DllCommonsvc.exe	146
PID 4776 wrote to memory of 2308	4776	DllCommonsvc.exe	148
PID 4776 wrote to memory of 2308	4776	DllCommonsvc.exe	148
PID 4776 wrote to memory of 3756	4776	DllCommonsvc.exe	149
PID 4776 wrote to memory of 3756	4776	DllCommonsvc.exe	149
PID 4776 wrote to memory of 3796	4776	DllCommonsvc.exe	151
PID 4776 wrote to memory of 3796	4776	DllCommonsvc.exe	151
PID 4776 wrote to memory of 4544	4776	DllCommonsvc.exe	153
PID 4776 wrote to memory of 4544	4776	DllCommonsvc.exe	153
PID 4776 wrote to memory of 4868	4776	DllCommonsvc.exe	156
PID 4776 wrote to memory of 4868	4776	DllCommonsvc.exe	156
PID 4776 wrote to memory of 3936	4776	DllCommonsvc.exe	157
PID 4776 wrote to memory of 3936	4776	DllCommonsvc.exe	157
PID 4776 wrote to memory of 1500	4776	DllCommonsvc.exe	158
PID 4776 wrote to memory of 1500	4776	DllCommonsvc.exe	158
PID 4776 wrote to memory of 3524	4776	DllCommonsvc.exe	159
PID 4776 wrote to memory of 3524	4776	DllCommonsvc.exe	159
PID 4776 wrote to memory of 1532	4776	DllCommonsvc.exe	161
PID 4776 wrote to memory of 1532	4776	DllCommonsvc.exe	161
PID 4776 wrote to memory of 3208	4776	DllCommonsvc.exe	168
PID 4776 wrote to memory of 3208	4776	DllCommonsvc.exe	168
PID 4776 wrote to memory of 1412	4776	DllCommonsvc.exe	166
PID 4776 wrote to memory of 1412	4776	DllCommonsvc.exe	166
PID 4776 wrote to memory of 2700	4776	DllCommonsvc.exe	163
PID 4776 wrote to memory of 2700	4776	DllCommonsvc.exe	163
PID 4776 wrote to memory of 5036	4776	DllCommonsvc.exe	172
PID 4776 wrote to memory of 5036	4776	DllCommonsvc.exe	172
PID 4776 wrote to memory of 4976	4776	DllCommonsvc.exe	178
PID 4776 wrote to memory of 4976	4776	DllCommonsvc.exe	178
PID 4776 wrote to memory of 4496	4776	DllCommonsvc.exe	174
PID 4776 wrote to memory of 4496	4776	DllCommonsvc.exe	174
PID 4776 wrote to memory of 3136	4776	DllCommonsvc.exe	181
PID 4776 wrote to memory of 3136	4776	DllCommonsvc.exe	181
PID 3136 wrote to memory of 5600	3136	cmd.exe	183
PID 3136 wrote to memory of 5600	3136	cmd.exe	183
PID 3136 wrote to memory of 5996	3136	cmd.exe	184
PID 3136 wrote to memory of 5996	3136	cmd.exe	184
PID 5996 wrote to memory of 6136	5996	taskhostw.exe	185
PID 5996 wrote to memory of 6136	5996	taskhostw.exe	185
PID 6136 wrote to memory of 1368	6136	cmd.exe	186
PID 6136 wrote to memory of 1368	6136	cmd.exe	186
PID 6136 wrote to memory of 5008	6136	cmd.exe	189
PID 6136 wrote to memory of 5008	6136	cmd.exe	189
PID 5008 wrote to memory of 5188	5008	taskhostw.exe	192
PID 5008 wrote to memory of 5188	5008	taskhostw.exe	192
PID 5188 wrote to memory of 5736	5188	cmd.exe	190
PID 5188 wrote to memory of 5736	5188	cmd.exe	190
PID 5188 wrote to memory of 2044	5188	cmd.exe	193
PID 5188 wrote to memory of 2044	5188	cmd.exe	193

C:\Users\Admin\AppData\Local\Temp\cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe
"C:\Users\Admin\AppData\Local\Temp\cf6726afcf42366cd027c4f7967a139fe829a809ac4ec8705d50309e9157928b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Registry.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SppExtComObj.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\TrustedInstaller.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\es-ES\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\migwiz\de-DE\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Teqwt2Oo5i.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3136
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5600
      - C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDWALPrpmL.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1368
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5188
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat"
        11⤵
        
        PID:1508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3860
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\61cJPf1Vjg.bat"
        13⤵
        
        PID:4716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3632
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat"
        15⤵
        
        PID:3128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4988
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat"
        17⤵
        
        PID:544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1948
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
        19⤵
        
        PID:5340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2232
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"
        21⤵
        
        PID:5108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4720
        
        C:\providercommon\taskhostw.exe
        
        "C:\providercommon\taskhostw.exe"
        22⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvFVSjZSRs.bat"
        23⤵
        
        PID:228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\odt\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\odt\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 5 /tr "'C:\odt\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Searches\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Searches\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Searches\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\System32\migwiz\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\migwiz\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\System32\migwiz\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:5736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat

Filesize
196B

MD5
da38d039417d6acef0ff85ab2839a40d

SHA1
f07c3fadf34fcc2afd163d7e2a58217d54283046

SHA256
4cefc6c36e64a7a7a78bd81202c6ed45bb8b88877bd15e181787444a4c2d732f

SHA512
e43a365861f14a46d3e091c803be540c89fec7039407c75a9523bbc8f329b2871f2fb2f0b3ce2a519db4f859c599b97ae1f4d62e0d773f9335f0112d2b9476f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\61cJPf1Vjg.bat

Filesize
196B

MD5
51e555d53f00d34527c4a607f467acf2

SHA1
dd9ddb59adc75ed63c5ac0471a357a6971abd40a

SHA256
e279ce2c4897d8528232b954eb6bba230bbb4c7f963b4b3a0ebc4f2640456d10

SHA512
18dfd3339828afe7e74802bee61a9ff570b4f7059dda7d204e5d3f2f8449eac09de76b7fc88470bacdd740a3fd5317c80445609b7dc9fcdf43e9a200b02fc16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat

Filesize
196B

MD5
67d5f397eab4ee2f7e38967444011fca

SHA1
86536a5ad64b877713956fa414b9bd1e2a5b9664

SHA256
b1a6f36063207a21ed0d818c5685a049f90118f294aed2396e1bf6491dc823e4

SHA512
28638412b2f622895cd6725e9220e6c9e4a490a551bab14c59c7d8b57b2fc07e64818db08d21d535778b115f0c667ea276264a432b9a2c65073f2df5a815dd08

Download Submit
C:\Users\Admin\AppData\Local\Temp\GvFVSjZSRs.bat

Filesize
196B

MD5
a0206cb818b6676f961263fbc59bb628

SHA1
e6212f75b6711c4d8cd5f9877a6b39d249bfb135

SHA256
84b722c540c3cb449a27d5830d9a167dd0019ba6d8d4524d24dfe4fe2510e1e5

SHA512
9f19c2bf409cd8db27aa5c7fd13a8b4dae01f3ff3d3d3449f7d9bee2bd94132ff37722302e013a0697dcae17ad46c2f6c5bce4cb4096ab82d4517b213f8017b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat

Filesize
196B

MD5
0d1c0cc07ecf157c33c2a00e5e04dc7a

SHA1
64cd50761c7099e0cb8e1e5c948aa90a75662fc8

SHA256
5ef9128dbc168f3f8a93745e1fa27405e6db05b882eee3e00ccd3971f3a23008

SHA512
01ac42366d011e7b179db7e07ce3313ac4c2325de7d8bc74e049f80d0784caf68134796479b50fb83f0325ce3193f3824d7d16654d6f280871e3b4c0cf559a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Teqwt2Oo5i.bat

Filesize
196B

MD5
be22bda4b34ee76b4c15c7ecad4aca6b

SHA1
91f483c31e62936ac2015e99c74ea17d944e7bde

SHA256
65c04c6980ad80627cfd83a454d8070236d499a750046f109451e19da2e07f5f

SHA512
d9257f7528dd37b9bbb0516726c9db120536d60d9c667f709e29e32f4e3a29398b66c2ee7a2beddb45d3132b7124165828cd6397d71191b1b1380943a7d5c0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

Filesize
196B

MD5
d27ad522250bf5e4080e58d0eaffccb3

SHA1
b4afbd0c3e9e1baf3f4491fc0081d212abba857a

SHA256
791a2d76f46e7d2ac9147dc442146db9a4bfa752816aee89b5da361b32ef7c4b

SHA512
38d221d6c95f0e4295a92a381ee56155aed0de7e4d884709017b2e2b4e2518cd749a09d2c14893c2d9d5c8e980d3f872f62c738b7fe4ac37bac15c9f5e0c7099

Download Submit
C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat

Filesize
196B

MD5
1281ce0157020df98112a5c415e613c9

SHA1
c8c898c1b7c3abc7231766f605e1447fb60bff96

SHA256
2e1d88781da4720365a22781e3953f033f0d5a1cf6f3d547a0ae9dbeb90c9d52

SHA512
e05b1530a295f1102e8f7dd95f6e2ac241dcc684ad489b8a8fb964a072bef0ad36fa417d80c0d7f98745736bb5db528251709c829d0c00273b395e4f9d4fa2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat

Filesize
196B

MD5
6175f23e52e50d73221613204916ceb1

SHA1
6eebd4ae2d48f77e8139ee945e3cc06fbfd6e3c9

SHA256
87d187a48dff64468a0b726d3e6dd165cbd27bb4f83ad9b0b23bfa894e94d4b8

SHA512
e0b28229ddc1e8f6caae5a753d2c3e764f079684d14cac3fcaaa1a94e1362ec238323006cb6e99e7df523bbc152f92956c1125c235e8357890c2eee057292e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zDWALPrpmL.bat

Filesize
196B

MD5
d727992f316c4550042fd44a490d26a8

SHA1
73bb3a3de27d4c9287e1a376dd2e89334a311730

SHA256
5c4c0bca506c28614e4fdd91d293fc32d4061c15297cd57c2e030ab0fb8a0beb

SHA512
a0619d3b91539ba0732b287cea9c391815ea85bad31d54815fe46468dbe4b99abeaab5966e438ea59e196a2bbb44d729ad0768ed9a7a24789780eb375983e17d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1412-172-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1412-209-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1500-202-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1500-169-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1532-218-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/1532-170-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2044-240-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2044-244-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2176-272-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2176-268-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2308-198-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2308-165-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2368-158-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2368-192-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2700-183-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/2700-221-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3208-182-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3208-217-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3336-208-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3336-155-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3524-212-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3524-181-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3756-197-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3756-178-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3796-166-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3796-195-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3936-214-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3936-180-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3960-261-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/3960-265-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4280-152-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4280-160-0x00000280D38A0000-0x00000280D38C2000-memory.dmp

Filesize
136KB

Download
memory/4280-189-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4496-220-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4496-175-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4544-167-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4544-203-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4596-188-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4596-162-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4776-171-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4776-139-0x00000000000D0000-0x00000000001E0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-140-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4868-207-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4868-179-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4976-201-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/4976-174-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5008-237-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5008-233-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5036-190-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5036-173-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5128-254-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5128-258-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5528-282-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5528-286-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5768-251-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5768-247-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5880-275-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5880-279-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5996-229-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download
memory/5996-225-0x00007FF963CA0000-0x00007FF964761000-memory.dmp

Filesize
10.8MB

Download