dcrat | cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d

Analysis

max time kernel
146s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01-11-2022 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe
Size

1.3MB
MD5

f9d9ee07c2f5a101369eb3d881bf866f
SHA1

6453c5997a54fe46c80bab28b70877622527006f
SHA256

cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d
SHA512

51b67f68c44bc5ed591b8bcc3b0f9e01a3b8fe0236492c142440cb36b459cd9430ef95838b62d463fc52785376628bf2540572b16912b711d1c038a403537769
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	500	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	160	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	4236	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	4236	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000600000001ac24-280.dat	dcrat
behavioral1/files/0x000600000001ac24-281.dat	dcrat
behavioral1/memory/4868-282-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac32-369.dat	dcrat
behavioral1/files/0x000600000001ac32-368.dat	dcrat
behavioral1/files/0x000600000001ac32-854.dat	dcrat
behavioral1/files/0x000600000001ac32-861.dat	dcrat
behavioral1/files/0x000600000001ac32-866.dat	dcrat
behavioral1/files/0x000600000001ac32-872.dat	dcrat
behavioral1/files/0x000600000001ac32-878.dat	dcrat
behavioral1/files/0x000600000001ac32-883.dat	dcrat
behavioral1/files/0x000600000001ac32-888.dat	dcrat
behavioral1/files/0x000600000001ac32-893.dat	dcrat
behavioral1/files/0x000600000001ac32-896.dat	dcrat
behavioral1/files/0x000600000001ac32-902.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
4868	DllCommonsvc.exe
4308	explorer.exe
5340	explorer.exe
5524	explorer.exe
5704	explorer.exe
5884	explorer.exe
6064	explorer.exe
2252	explorer.exe
5216	explorer.exe
2388	explorer.exe
3132	explorer.exe
1992	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\en-US\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\en-US\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\LocalService\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2188	schtasks.exe
3812	schtasks.exe
1612	schtasks.exe
1196	schtasks.exe
3292	schtasks.exe
3260	schtasks.exe
656	schtasks.exe
1328	schtasks.exe
624	schtasks.exe
696	schtasks.exe
3140	schtasks.exe
5008	schtasks.exe
4580	schtasks.exe
4532	schtasks.exe
3040	schtasks.exe
4204	schtasks.exe
3692	schtasks.exe
1564	schtasks.exe
160	schtasks.exe
4568	schtasks.exe
4700	schtasks.exe
1624	schtasks.exe
4652	schtasks.exe
500	schtasks.exe
2088	schtasks.exe
1880	schtasks.exe
4952	schtasks.exe
3168	schtasks.exe
4556	schtasks.exe
4232	schtasks.exe
4680	schtasks.exe
4416	schtasks.exe
5092	schtasks.exe
5076	schtasks.exe
1224	schtasks.exe
4696	schtasks.exe
220	schtasks.exe
4480	schtasks.exe
416	schtasks.exe
644	schtasks.exe
4728	schtasks.exe
3300	schtasks.exe
4508	schtasks.exe
364	schtasks.exe
4596	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
4868	DllCommonsvc.exe
1020	powershell.exe
1020	powershell.exe
1020	powershell.exe
856	powershell.exe
856	powershell.exe
2196	powershell.exe
2196	powershell.exe
2708	powershell.exe
2708	powershell.exe
2724	powershell.exe
2724	powershell.exe
2620	powershell.exe
2620	powershell.exe
2396	powershell.exe
2396	powershell.exe
3400	powershell.exe
3400	powershell.exe
3800	powershell.exe
3800	powershell.exe
4892	powershell.exe
4892	powershell.exe
3248	powershell.exe
3248	powershell.exe
2276	powershell.exe
2276	powershell.exe
2708	powershell.exe
4820	powershell.exe
4820	powershell.exe
2224	powershell.exe
2224	powershell.exe
1020	powershell.exe
4816	powershell.exe
4816	powershell.exe
2396	powershell.exe
3396	powershell.exe
3396	powershell.exe
4892	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	DllCommonsvc.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	4308	explorer.exe
Token: SeIncreaseQuotaPrivilege	1020	powershell.exe
Token: SeSecurityPrivilege	1020	powershell.exe
Token: SeTakeOwnershipPrivilege	1020	powershell.exe
Token: SeLoadDriverPrivilege	1020	powershell.exe
Token: SeSystemProfilePrivilege	1020	powershell.exe
Token: SeSystemtimePrivilege	1020	powershell.exe
Token: SeProfSingleProcessPrivilege	1020	powershell.exe
Token: SeIncBasePriorityPrivilege	1020	powershell.exe
Token: SeCreatePagefilePrivilege	1020	powershell.exe
Token: SeBackupPrivilege	1020	powershell.exe
Token: SeRestorePrivilege	1020	powershell.exe
Token: SeShutdownPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeSystemEnvironmentPrivilege	1020	powershell.exe
Token: SeRemoteShutdownPrivilege	1020	powershell.exe
Token: SeUndockPrivilege	1020	powershell.exe
Token: SeManageVolumePrivilege	1020	powershell.exe
Token: 33	1020	powershell.exe
Token: 34	1020	powershell.exe
Token: 35	1020	powershell.exe
Token: 36	1020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2708	powershell.exe
Token: SeSecurityPrivilege	2708	powershell.exe
Token: SeTakeOwnershipPrivilege	2708	powershell.exe
Token: SeLoadDriverPrivilege	2708	powershell.exe
Token: SeSystemProfilePrivilege	2708	powershell.exe
Token: SeSystemtimePrivilege	2708	powershell.exe
Token: SeProfSingleProcessPrivilege	2708	powershell.exe
Token: SeIncBasePriorityPrivilege	2708	powershell.exe
Token: SeCreatePagefilePrivilege	2708	powershell.exe
Token: SeBackupPrivilege	2708	powershell.exe
Token: SeRestorePrivilege	2708	powershell.exe
Token: SeShutdownPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeSystemEnvironmentPrivilege	2708	powershell.exe
Token: SeRemoteShutdownPrivilege	2708	powershell.exe
Token: SeUndockPrivilege	2708	powershell.exe
Token: SeManageVolumePrivilege	2708	powershell.exe
Token: 33	2708	powershell.exe
Token: 34	2708	powershell.exe
Token: 35	2708	powershell.exe
Token: 36	2708	powershell.exe
Token: SeIncreaseQuotaPrivilege	2396	powershell.exe
Token: SeSecurityPrivilege	2396	powershell.exe
Token: SeTakeOwnershipPrivilege	2396	powershell.exe
Token: SeLoadDriverPrivilege	2396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4288	3060	cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe	66
PID 3060 wrote to memory of 4288	3060	cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe	66
PID 3060 wrote to memory of 4288	3060	cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe	66
PID 4288 wrote to memory of 3912	4288	WScript.exe	67
PID 4288 wrote to memory of 3912	4288	WScript.exe	67
PID 4288 wrote to memory of 3912	4288	WScript.exe	67
PID 3912 wrote to memory of 4868	3912	cmd.exe	69
PID 3912 wrote to memory of 4868	3912	cmd.exe	69
PID 4868 wrote to memory of 856	4868	DllCommonsvc.exe	116
PID 4868 wrote to memory of 856	4868	DllCommonsvc.exe	116
PID 4868 wrote to memory of 1020	4868	DllCommonsvc.exe	118
PID 4868 wrote to memory of 1020	4868	DllCommonsvc.exe	118
PID 4868 wrote to memory of 2196	4868	DllCommonsvc.exe	120
PID 4868 wrote to memory of 2196	4868	DllCommonsvc.exe	120
PID 4868 wrote to memory of 2708	4868	DllCommonsvc.exe	122
PID 4868 wrote to memory of 2708	4868	DllCommonsvc.exe	122
PID 4868 wrote to memory of 2724	4868	DllCommonsvc.exe	132
PID 4868 wrote to memory of 2724	4868	DllCommonsvc.exe	132
PID 4868 wrote to memory of 2620	4868	DllCommonsvc.exe	131
PID 4868 wrote to memory of 2620	4868	DllCommonsvc.exe	131
PID 4868 wrote to memory of 2396	4868	DllCommonsvc.exe	130
PID 4868 wrote to memory of 2396	4868	DllCommonsvc.exe	130
PID 4868 wrote to memory of 3800	4868	DllCommonsvc.exe	129
PID 4868 wrote to memory of 3800	4868	DllCommonsvc.exe	129
PID 4868 wrote to memory of 3400	4868	DllCommonsvc.exe	128
PID 4868 wrote to memory of 3400	4868	DllCommonsvc.exe	128
PID 4868 wrote to memory of 2276	4868	DllCommonsvc.exe	147
PID 4868 wrote to memory of 2276	4868	DllCommonsvc.exe	147
PID 4868 wrote to memory of 3248	4868	DllCommonsvc.exe	134
PID 4868 wrote to memory of 3248	4868	DllCommonsvc.exe	134
PID 4868 wrote to memory of 4820	4868	DllCommonsvc.exe	145
PID 4868 wrote to memory of 4820	4868	DllCommonsvc.exe	145
PID 4868 wrote to memory of 4892	4868	DllCommonsvc.exe	135
PID 4868 wrote to memory of 4892	4868	DllCommonsvc.exe	135
PID 4868 wrote to memory of 4816	4868	DllCommonsvc.exe	144
PID 4868 wrote to memory of 4816	4868	DllCommonsvc.exe	144
PID 4868 wrote to memory of 3396	4868	DllCommonsvc.exe	138
PID 4868 wrote to memory of 3396	4868	DllCommonsvc.exe	138
PID 4868 wrote to memory of 2224	4868	DllCommonsvc.exe	139
PID 4868 wrote to memory of 2224	4868	DllCommonsvc.exe	139
PID 4868 wrote to memory of 4308	4868	DllCommonsvc.exe	148
PID 4868 wrote to memory of 4308	4868	DllCommonsvc.exe	148
PID 4308 wrote to memory of 1616	4308	explorer.exe	150
PID 4308 wrote to memory of 1616	4308	explorer.exe	150
PID 1616 wrote to memory of 4512	1616	cmd.exe	152
PID 1616 wrote to memory of 4512	1616	cmd.exe	152
PID 1616 wrote to memory of 5340	1616	cmd.exe	153
PID 1616 wrote to memory of 5340	1616	cmd.exe	153
PID 5340 wrote to memory of 5448	5340	explorer.exe	156
PID 5340 wrote to memory of 5448	5340	explorer.exe	156
PID 5448 wrote to memory of 5504	5448	cmd.exe	155
PID 5448 wrote to memory of 5504	5448	cmd.exe	155
PID 5448 wrote to memory of 5524	5448	cmd.exe	157
PID 5448 wrote to memory of 5524	5448	cmd.exe	157
PID 5524 wrote to memory of 5628	5524	explorer.exe	159
PID 5524 wrote to memory of 5628	5524	explorer.exe	159
PID 5628 wrote to memory of 5684	5628	cmd.exe	160
PID 5628 wrote to memory of 5684	5628	cmd.exe	160
PID 5628 wrote to memory of 5704	5628	cmd.exe	161
PID 5628 wrote to memory of 5704	5628	cmd.exe	161
PID 5704 wrote to memory of 5808	5704	explorer.exe	164
PID 5704 wrote to memory of 5808	5704	explorer.exe	164
PID 5808 wrote to memory of 5864	5808	cmd.exe	163
PID 5808 wrote to memory of 5864	5808	cmd.exe	163

C:\Users\Admin\AppData\Local\Temp\cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe
"C:\Users\Admin\AppData\Local\Temp\cead19b90e68d44cac1be2a4e33c97f30070aefb525adf14c3c4b38a7a36279d.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\LocalService\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\en-US\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
    - - C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4512
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\42uKfvaRom.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5684
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat"
        14⤵
        
        PID:5988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:6044
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
        16⤵
        
        PID:5180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4468
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tGPC7CVf0d.bat"
        18⤵
        
        PID:4888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3912
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat"
        20⤵
        
        PID:4204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3856
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat"
        22⤵
        
        PID:3908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4168
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat"
        24⤵
        
        PID:5256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4768
        
        C:\Users\Default\explorer.exe
        
        "C:\Users\Default\explorer.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat"
        26⤵
        
        PID:2724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\LocalService\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\LocalService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\en-US\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\en-US\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:5504

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aa5edf81798112655a2f0bd22dce6882

SHA1
2fb1b3f2eb08d23b2a9e0edeca93c46cf9500269

SHA256
828b7893b1085bcca72911fe1909715d003f9670ac6adaf51a52ddd11a2ba2ab

SHA512
c0a0114fbf92e4f992239fde8b6bf437a2308ac18736780e792f7c75914aac953bb971c209f63d907a1e9fde67e8dfb9ba94aae45cc2651853316efc7ff777d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cc426d337f597f6f808484c3ac5e7ceb

SHA1
cf3de14a770f3cb17d8eacad2fcfaf360c80d6da

SHA256
5703420fc5e0801463c94871d0f29ca9702e01f45d92ee701e653bfe614db481

SHA512
40620285af304c2852e4a435dd00ec21b1c57efd8a9119e7ad384e893355aeaa0764c51c131520f4108a971610419bae3c7f1d48618be35d1cb97074615d556f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7ea38c3e0b22ff32c274edb0e0cb2c59

SHA1
ccb57d24131fdf324bb70921c14a75e3ed855a19

SHA256
c84a1776d55fa2cbfb0aab0ff26738b89756a8be34c3684d6f1f45b4d0e96f9e

SHA512
043c626f448a7ddf9f4769cc7a7c5241d85fa41e690cb04c2b4b9db21afc8a890fc46f2c211b4379befa8c5e5801be042100179ba8f82984b947a1828ae1c191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7ea38c3e0b22ff32c274edb0e0cb2c59

SHA1
ccb57d24131fdf324bb70921c14a75e3ed855a19

SHA256
c84a1776d55fa2cbfb0aab0ff26738b89756a8be34c3684d6f1f45b4d0e96f9e

SHA512
043c626f448a7ddf9f4769cc7a7c5241d85fa41e690cb04c2b4b9db21afc8a890fc46f2c211b4379befa8c5e5801be042100179ba8f82984b947a1828ae1c191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af0cb088d294154e3530028a6856479c

SHA1
cf6e4f03762053d57ab97b4ab84c352ffe35b0d5

SHA256
1fb7f3ed6a84003f3ef8d00e1640614b1e813e0ef3c45127965fa7b0e769ca78

SHA512
df8b940062f9e81a846c45e7603dd88993d20518a79cb7e1f41cb1bbc1835d7ed77b2494e9026072a0418e6d75a81865e479ee6fc6587f875d4c01fe345334ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af0cb088d294154e3530028a6856479c

SHA1
cf6e4f03762053d57ab97b4ab84c352ffe35b0d5

SHA256
1fb7f3ed6a84003f3ef8d00e1640614b1e813e0ef3c45127965fa7b0e769ca78

SHA512
df8b940062f9e81a846c45e7603dd88993d20518a79cb7e1f41cb1bbc1835d7ed77b2494e9026072a0418e6d75a81865e479ee6fc6587f875d4c01fe345334ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
04b489a2981e0ba5d6ba8f46eb3ebad9

SHA1
e7ab441aa1ae2f78a90c8450eafe4f83364674f3

SHA256
5a390e849536d509a49ead03a20f4c02d19c3e29e3c78f973ead742b6b892b56

SHA512
b6464ee8b1496598e0fd9b8e1fa6b6f63bce93b6f7cdc24a261a88dbd04d5564803ae2441d4460cb4010a6127a2436c1db094d7dac2056a4ef32a4f88d8b16eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
04b489a2981e0ba5d6ba8f46eb3ebad9

SHA1
e7ab441aa1ae2f78a90c8450eafe4f83364674f3

SHA256
5a390e849536d509a49ead03a20f4c02d19c3e29e3c78f973ead742b6b892b56

SHA512
b6464ee8b1496598e0fd9b8e1fa6b6f63bce93b6f7cdc24a261a88dbd04d5564803ae2441d4460cb4010a6127a2436c1db094d7dac2056a4ef32a4f88d8b16eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
055b70c5472ff318ae2407eee6e0a338

SHA1
415e713953000da5bab0b4ec25802c747d39d418

SHA256
ecd57b357790af39c47050dc2e6ecbade42c76390c5257693aed7b88dc68975f

SHA512
67b3ee7ceb00955736e201f5fdf2d95297cfce7aed2baff5db319e766f5f459de76bc6bab67d581bf6c812ef6031e24b3bf12982d4ab9136f8f63eb34363582b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1febc97b33571c45cf158eecb778d04e

SHA1
621580d0fe95e0ff7fa380738e280392d10cb89c

SHA256
2538686802d1a2f8fcffa05dfdf7be54c96d90b735a8da80bba74b740f9efb84

SHA512
dbe8dcf8a63990a2965d95e1d91ec144e4a4cd578d2df5d7a3406946d96ce52964fd56c5a89fe1fde0217778d5a3246914e62d6a0575020ed9a3bb62757f6ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1febc97b33571c45cf158eecb778d04e

SHA1
621580d0fe95e0ff7fa380738e280392d10cb89c

SHA256
2538686802d1a2f8fcffa05dfdf7be54c96d90b735a8da80bba74b740f9efb84

SHA512
dbe8dcf8a63990a2965d95e1d91ec144e4a4cd578d2df5d7a3406946d96ce52964fd56c5a89fe1fde0217778d5a3246914e62d6a0575020ed9a3bb62757f6ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5f561658131ec7b30dbdeb6bcb2b9088

SHA1
2c4ba070c6c2e5479a94cf3e3d1103ac2c63563e

SHA256
1e041da61dfeb8df6e8989c733615421b8744187ed2cb1949bd13f1ac1d21f3e

SHA512
1095beb9bfc8c2894d260561205e99d6c7fea3a0857a1984f819d661b73c84fece342350847235f64abf3bc8a55b16281ea9e8b8d690add787b6e2b96529d659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
92739acc42555cf53a5eda1f2e89d4e7

SHA1
ad173412a716f22a10f4e54f636900c1fbe6d2eb

SHA256
8f9027d65bced99f8c47f41aa906c01869cecc55e432f6adcfc95b874dbc2211

SHA512
daf955a3402a3eebc056e5ea69966df683c95c964f55c1b940481d80ea0d93b9a9060ab5606891f714f06bc828471ba07475730b0c485140ea54871018a8acc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\42uKfvaRom.bat

Filesize
194B

MD5
549ad1d018d2137546f0c271f78ea34c

SHA1
6ea825e3a987c921d36701e6638d68946cd139f1

SHA256
322e2a9a4363b405d7304394c40812804a847f929ef1b9e728a0cd4b493249e5

SHA512
bb75fbe5ec478af2c35c8f497ac2cd874cf399e29113b92ced5ea50e7709475a78676b25c177d03ff44b2e1fa3a721dadb525709c2a7072ff8efb5f2a50c340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat

Filesize
194B

MD5
3103de24bb4f4f92044ec67aebf3f68f

SHA1
58ef8bfaeca2365899883a1ae7ea4ec24dc9d2ea

SHA256
5d73c33d73a3ab500b2184a9052f66da21c545e4b315cceb4a456cfb97469952

SHA512
b0eccb996b7d80ee3c5cb1c3cf2df57977ad52f34fa362fb29da09942e0255264ff3868963407fe7156808abbc6ba42fa00874f92703a8a19fe23af853fba44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat

Filesize
194B

MD5
4647cb2269dce41004d2bb0c7d1effc5

SHA1
17a0ab16664cbfcfd183d17d631b969a1761e673

SHA256
9994598110699c280c0b2069523c25de38ba99f75cfd6eedfeb684361f9ac590

SHA512
11c6d661d371862e6f8537ddcc6d4ddccc654a6fc2a1d3c025d4c0107d470725ce51a322bfe9748332e2a529a9729882a0d6f2be99fd72986dfcd0783fc823e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat

Filesize
194B

MD5
9bd22f632e5a9545355542e01e6e92c8

SHA1
1157b0e2eeab4e93981618b63e08e5a5f16a74db

SHA256
cfbbaf677ff0a994bfd9ec4a3dcda13ec6dc170ed72c44052f03e7a154c42893

SHA512
9ce8fd742cf106937236691913083b04aa749b0e07a09867f7ccce8b28dab3cb040548b77f7d85643c44031ee1d942edb5120951a9ff1d47cd04e506c84921fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat

Filesize
194B

MD5
bf80ea3d5fa09423e85cdfee17ed912c

SHA1
968cf713a1e548d5231f162a24cab09e1c5adeb7

SHA256
1cc28a0cf0ab662724df82de3d31bb992fdea2f1a227268ab11f10b5ea5b34e3

SHA512
d82a545e9b9589035812f3a93532bc18908bf4d110a2a53e0c89acd7386b165485f40437fcdd0b4a32cf3174756ad74868ae4a46c52b5d210110ef86fe1da8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat

Filesize
194B

MD5
6b832c925473f957edb499cb185810e6

SHA1
00d7036ba78c3d917399da22338b4b9de534a183

SHA256
6d5b9e65a716edc4561117986fd6ad2a16dd99e867d34a24027878f4838719b3

SHA512
8c9d151ff04cbcdf061cd0992074a5d117ed283d497c497c3ac1703970a8b9d85d80f306896f765b136275a224b73ca890b037abd87c1fcf3d13f4388f0dc2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat

Filesize
194B

MD5
0fc8d989c7511ff1ae70df780e49fe7e

SHA1
faf4fb3af551044d9adae9277cfd809d033ad259

SHA256
facb1e61cd8ec2278ae2864efe9f9c8ff7e9218c2422e14a9088e757bdba6a02

SHA512
c0dcdba7f703625ede1043fc19369a20104a65a90582e856ff46f24bfa28e0c337d0b631a3aac41469c85bf5eed17d644150257fcc1598a02f8685ec7405077d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

Filesize
194B

MD5
a4fcd907cf58b236cc497cfe8df5bc7f

SHA1
501dfc517b73e9ca29bf289b33f8d218bc36fd4e

SHA256
be55357ce21553d625f4053f2259f37682feb9bb738481606516bc6bc4d0aa7b

SHA512
0e679bd00ae33d8d1a1955cb37dce672f73fed5649a050c749a2ff87859d2535f72a2e9e4d6d3c852f18c52de96f7aa9c21e19b499b5326071816bcb25c243d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat

Filesize
194B

MD5
5d195b96aeaebc19859c0dea3ec4058d

SHA1
ca17572cd2fcfd6bf3599661a7b1b5184def12a9

SHA256
dec807280eff4705757e3e9cb716e8d9da7e1862981a7821a11d55a59f35c1db

SHA512
35e1fbe24e246b679133273a249c39350fb767849af41624ea9ac2a92fa5a87042e47dd94e716642ff3c8bb22592f59de61f3f0e221ad66a42c3ecb88b7386a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tGPC7CVf0d.bat

Filesize
194B

MD5
5204a85932ab040be7b7710ef73509fe

SHA1
c57b861c1b89d3c0f54ed7c4cd438d716bb05b3e

SHA256
3e413e644139dc50520a19ef34ec314f7852a6f6f6c4e1b82100e76f3c3906f2

SHA512
9858f0b718cdc946e60ea13fa7f02219093b2570504ddb5dc973ea7dd539675fde7fcee1b887af7755fd6964bd80705759a7e2b164fd2fb2ead219264fb2fa61

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1020-370-0x0000024DA1520000-0x0000024DA1542000-memory.dmp

Filesize
136KB

Download
memory/1020-373-0x0000024DA16D0000-0x0000024DA1746000-memory.dmp

Filesize
472KB

Download
memory/3060-159-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-157-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-177-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-178-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-179-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-132-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-134-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-131-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-175-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-174-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-130-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-118-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-173-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-172-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-117-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-119-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-121-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-135-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-122-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-171-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-170-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-166-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-129-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-169-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-168-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-167-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-165-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-176-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-136-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-128-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-164-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-137-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-138-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-163-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-127-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-126-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-162-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-161-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-160-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-116-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-158-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-133-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-139-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-156-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-155-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-154-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-153-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-152-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-151-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-150-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-148-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-149-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-147-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-146-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-145-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-143-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-144-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-124-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-142-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-141-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-140-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3060-125-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3132-897-0x0000000002D60000-0x0000000002D72000-memory.dmp

Filesize
72KB

Download
memory/4288-182-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/4288-181-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/4868-285-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Filesize
48KB

Download
memory/4868-286-0x0000000002480000-0x000000000248C000-memory.dmp

Filesize
48KB

Download
memory/4868-284-0x0000000002490000-0x000000000249C000-memory.dmp

Filesize
48KB

Download
memory/4868-283-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

Filesize
72KB

Download
memory/4868-282-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/5340-856-0x0000000001670000-0x0000000001682000-memory.dmp

Filesize
72KB

Download
memory/5704-867-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/5884-873-0x00000000008E0000-0x00000000008F2000-memory.dmp

Filesize
72KB

Download