dcrat | b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34

Analysis

max time kernel
149s
max time network
146s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe
Size

1.3MB
MD5

35a6c54e12bfb338b2609451718b36d6
SHA1

1d4e045b8448f7f0cb901b931a8c334d41ea734f
SHA256

b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34
SHA512

7fba3c5149f84216b658c621df154767d73318284b54fee770eb6df8ffa42b38b488bbb1680a79dbfe7223e4b17be7f7ef095595e4f5cc56f3ecf07b1866fe49
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	4948	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	4948	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac32-284.dat	dcrat
behavioral1/files/0x000800000001ac32-285.dat	dcrat
behavioral1/memory/5044-286-0x0000000000BB0000-0x0000000000CC0000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac4f-483.dat	dcrat
behavioral1/files/0x000600000001ac4f-484.dat	dcrat
behavioral1/files/0x000600000001ac4f-513.dat	dcrat
behavioral1/files/0x000600000001ac4f-519.dat	dcrat
behavioral1/files/0x000600000001ac4f-524.dat	dcrat
behavioral1/files/0x000600000001ac4f-529.dat	dcrat
behavioral1/files/0x000600000001ac4f-534.dat	dcrat
behavioral1/files/0x000600000001ac4f-540.dat	dcrat
behavioral1/files/0x000600000001ac4f-545.dat	dcrat
behavioral1/files/0x000600000001ac4f-550.dat	dcrat
behavioral1/files/0x000600000001ac4f-555.dat	dcrat
behavioral1/files/0x000600000001ac4f-560.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
5044	DllCommonsvc.exe
3648	SearchUI.exe
212	SearchUI.exe
2980	SearchUI.exe
5112	SearchUI.exe
4804	SearchUI.exe
3384	SearchUI.exe
4072	SearchUI.exe
652	SearchUI.exe
1008	SearchUI.exe
4620	SearchUI.exe
3112	SearchUI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\bin\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\bin\5b884080fd4f94	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\schemas\CodeIntegrity\SearchUI.exe	DllCommonsvc.exe
File created	C:\Windows\schemas\CodeIntegrity\dab4d89cac03ec	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3104	schtasks.exe
1840	schtasks.exe
2220	schtasks.exe
3176	schtasks.exe
3576	schtasks.exe
2416	schtasks.exe
4400	schtasks.exe
4416	schtasks.exe
4988	schtasks.exe
4840	schtasks.exe
5004	schtasks.exe
3916	schtasks.exe
3648	schtasks.exe
3136	schtasks.exe
4936	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	SearchUI.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5044	DllCommonsvc.exe
5044	DllCommonsvc.exe
5044	DllCommonsvc.exe
3868	powershell.exe
3932	powershell.exe
988	powershell.exe
4600	powershell.exe
4520	powershell.exe
4584	powershell.exe
4584	powershell.exe
3868	powershell.exe
3932	powershell.exe
988	powershell.exe
4600	powershell.exe
4520	powershell.exe
4584	powershell.exe
3932	powershell.exe
3868	powershell.exe
988	powershell.exe
4600	powershell.exe
4520	powershell.exe
3648	SearchUI.exe
212	SearchUI.exe
2980	SearchUI.exe
5112	SearchUI.exe
4804	SearchUI.exe
3384	SearchUI.exe
4072	SearchUI.exe
652	SearchUI.exe
1008	SearchUI.exe
4620	SearchUI.exe
3112	SearchUI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	DllCommonsvc.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeSystemEnvironmentPrivilege	4520	powershell.exe
Token: SeRemoteShutdownPrivilege	4520	powershell.exe
Token: SeUndockPrivilege	4520	powershell.exe
Token: SeManageVolumePrivilege	4520	powershell.exe
Token: 33	4520	powershell.exe
Token: 34	4520	powershell.exe
Token: 35	4520	powershell.exe
Token: 36	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4528	1748	b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe	66
PID 1748 wrote to memory of 4528	1748	b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe	66
PID 1748 wrote to memory of 4528	1748	b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe	66
PID 4528 wrote to memory of 4268	4528	WScript.exe	67
PID 4528 wrote to memory of 4268	4528	WScript.exe	67
PID 4528 wrote to memory of 4268	4528	WScript.exe	67
PID 4268 wrote to memory of 5044	4268	cmd.exe	69
PID 4268 wrote to memory of 5044	4268	cmd.exe	69
PID 5044 wrote to memory of 3932	5044	DllCommonsvc.exe	86
PID 5044 wrote to memory of 3932	5044	DllCommonsvc.exe	86
PID 5044 wrote to memory of 3868	5044	DllCommonsvc.exe	88
PID 5044 wrote to memory of 3868	5044	DllCommonsvc.exe	88
PID 5044 wrote to memory of 988	5044	DllCommonsvc.exe	92
PID 5044 wrote to memory of 988	5044	DllCommonsvc.exe	92
PID 5044 wrote to memory of 4600	5044	DllCommonsvc.exe	91
PID 5044 wrote to memory of 4600	5044	DllCommonsvc.exe	91
PID 5044 wrote to memory of 4520	5044	DllCommonsvc.exe	96
PID 5044 wrote to memory of 4520	5044	DllCommonsvc.exe	96
PID 5044 wrote to memory of 4584	5044	DllCommonsvc.exe	94
PID 5044 wrote to memory of 4584	5044	DllCommonsvc.exe	94
PID 5044 wrote to memory of 2252	5044	DllCommonsvc.exe	98
PID 5044 wrote to memory of 2252	5044	DllCommonsvc.exe	98
PID 2252 wrote to memory of 2776	2252	cmd.exe	100
PID 2252 wrote to memory of 2776	2252	cmd.exe	100
PID 2252 wrote to memory of 3648	2252	cmd.exe	101
PID 2252 wrote to memory of 3648	2252	cmd.exe	101
PID 3648 wrote to memory of 4228	3648	SearchUI.exe	103
PID 3648 wrote to memory of 4228	3648	SearchUI.exe	103
PID 4228 wrote to memory of 2836	4228	cmd.exe	105
PID 4228 wrote to memory of 2836	4228	cmd.exe	105
PID 4228 wrote to memory of 212	4228	cmd.exe	106
PID 4228 wrote to memory of 212	4228	cmd.exe	106
PID 212 wrote to memory of 3716	212	SearchUI.exe	107
PID 212 wrote to memory of 3716	212	SearchUI.exe	107
PID 3716 wrote to memory of 2732	3716	cmd.exe	109
PID 3716 wrote to memory of 2732	3716	cmd.exe	109
PID 3716 wrote to memory of 2980	3716	cmd.exe	110
PID 3716 wrote to memory of 2980	3716	cmd.exe	110
PID 2980 wrote to memory of 1760	2980	SearchUI.exe	111
PID 2980 wrote to memory of 1760	2980	SearchUI.exe	111
PID 1760 wrote to memory of 5100	1760	cmd.exe	113
PID 1760 wrote to memory of 5100	1760	cmd.exe	113
PID 1760 wrote to memory of 5112	1760	cmd.exe	114
PID 1760 wrote to memory of 5112	1760	cmd.exe	114
PID 5112 wrote to memory of 3476	5112	SearchUI.exe	115
PID 5112 wrote to memory of 3476	5112	SearchUI.exe	115
PID 3476 wrote to memory of 1456	3476	cmd.exe	117
PID 3476 wrote to memory of 1456	3476	cmd.exe	117
PID 3476 wrote to memory of 4804	3476	cmd.exe	118
PID 3476 wrote to memory of 4804	3476	cmd.exe	118
PID 4804 wrote to memory of 772	4804	SearchUI.exe	119
PID 4804 wrote to memory of 772	4804	SearchUI.exe	119
PID 772 wrote to memory of 2092	772	cmd.exe	121
PID 772 wrote to memory of 2092	772	cmd.exe	121
PID 772 wrote to memory of 3384	772	cmd.exe	122
PID 772 wrote to memory of 3384	772	cmd.exe	122
PID 3384 wrote to memory of 3176	3384	SearchUI.exe	123
PID 3384 wrote to memory of 3176	3384	SearchUI.exe	123
PID 3176 wrote to memory of 4536	3176	cmd.exe	125
PID 3176 wrote to memory of 4536	3176	cmd.exe	125
PID 3176 wrote to memory of 4072	3176	cmd.exe	126
PID 3176 wrote to memory of 4072	3176	cmd.exe	126
PID 4072 wrote to memory of 4588	4072	SearchUI.exe	127
PID 4072 wrote to memory of 4588	4072	SearchUI.exe	127

C:\Users\Admin\AppData\Local\Temp\b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe
"C:\Users\Admin\AppData\Local\Temp\b503de124079074916ff7816c4cc1a8cea20ab24463b0dccafec17497a709d34.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.8.0_66\db\bin\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\CodeIntegrity\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4520
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IUuBYBwkQ5.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2252
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2776
      - C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2836
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6oaLUsZTY.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2732
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwHeC7tSxv.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5100
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1456
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2092
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4536
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat"
        19⤵
        
        PID:4588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2116
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat"
        21⤵
        
        PID:1984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4436
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat"
        23⤵
        
        PID:304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2144
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat"
        25⤵
        
        PID:3288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4244
        
        C:\Windows\schemas\CodeIntegrity\SearchUI.exe
        
        "C:\Windows\schemas\CodeIntegrity\SearchUI.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk1.8.0_66\db\bin\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.8.0_66\db\bin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk1.8.0_66\db\bin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 13 /tr "'C:\Windows\schemas\CodeIntegrity\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Windows\schemas\CodeIntegrity\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\Windows\schemas\CodeIntegrity\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SearchUI.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4f1aa5459eb45621458d6986a6eb4f34

SHA1
64bbdb6ce77864ba93c6fc37913c49203960b64e

SHA256
341156176166a78e4fd19c305800ba96b53cd2592a97906c943191f69e87e892

SHA512
a543398650db48068d43be9d3ea288ae0ffcd2e736b70c85878a0e694212bdd47da8ed0f56c4090af40299eae77605d630b2e361eb2843d900b5a88cec7b838e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
90f9ddbb8d215e0cc182be32ef567b2e

SHA1
71d001dd58e9f3818ea56ca9e2097c800b9f52d2

SHA256
9330cdeb85380e7ff63d28da1341011ee3c6898378c3299ca67208d9a4c51634

SHA512
9345e5cfe26b4b3f9f6d847429f816ff3c7fa59426bc91f2377c5a0fd231e606b0dca8bb017a2553acf586b6c5bc3549a8bb8d5a531eb4c489f6c83e7617a6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
90f9ddbb8d215e0cc182be32ef567b2e

SHA1
71d001dd58e9f3818ea56ca9e2097c800b9f52d2

SHA256
9330cdeb85380e7ff63d28da1341011ee3c6898378c3299ca67208d9a4c51634

SHA512
9345e5cfe26b4b3f9f6d847429f816ff3c7fa59426bc91f2377c5a0fd231e606b0dca8bb017a2553acf586b6c5bc3549a8bb8d5a531eb4c489f6c83e7617a6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f4cebace363955b5fb79b606d1252b9e

SHA1
f57eb08ca60074896c6d65c98e2f8b99450f7aee

SHA256
ba0bf3227005c611f8d0d8ad6c73089c086e94019641f0fc14a303c760b6928a

SHA512
5d63af7b9754546535b86504494ffc6eb0ad79653f148ce4a2e9199badbdf582fac30c31dfeecf79b9d67b21b779d5e4132da8884e1d365c1ca380c719f1a52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f4cebace363955b5fb79b606d1252b9e

SHA1
f57eb08ca60074896c6d65c98e2f8b99450f7aee

SHA256
ba0bf3227005c611f8d0d8ad6c73089c086e94019641f0fc14a303c760b6928a

SHA512
5d63af7b9754546535b86504494ffc6eb0ad79653f148ce4a2e9199badbdf582fac30c31dfeecf79b9d67b21b779d5e4132da8884e1d365c1ca380c719f1a52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat

Filesize
210B

MD5
03ae66622bb8caa1fb60c0f64c860dab

SHA1
00dd3c18d32af856d69aeba6d574deccb9ee352e

SHA256
c740e4571cf029a2ff31a63055f81a6c7a1c0d826c2304f05caa9c4ae45103b3

SHA512
d4d134585a9ea587a19bdbfa5f3ce0e4383f12341962d943260d56b35f4e2993094fb1923d291c17904f61d38d10401d04cae36010852d3a65d9de8c7ba12a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat

Filesize
210B

MD5
7d3dff5855c757a1f015fb3f83ad190e

SHA1
79dfc9940d4b3d70bcdf5f6ee5a147fa32fa2679

SHA256
77a232e5b6a373a634dd992a67c56499c52b5d69171651712b5b93205842d94d

SHA512
275c48c54d5777069e5cb9bee9bacdee2d1a0a6b94211dee5ebf4e7cf1fe9df5fa3a240ed2ab3d0e62ff4b98690a0926ef673d6e37ced2cd6ca4376f6a30ca06

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat

Filesize
210B

MD5
afb8237140256cca819fbdc37f11aef5

SHA1
163840adc96be9ca197b891125e5ed15333c7ce5

SHA256
2f16157cc5c329ccfbf16f22205e973a4f10736f642b9c58defa48b9b37881c8

SHA512
abefb854f5821b6905c65a3601de56b46b12e3beb768dd06f7426428259de355bc25a5aaec13c5ca4e2175c0f14e5d562eb8d3e20c4d459758f2bc03ca59d271

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXR1U0Y5m3.bat

Filesize
210B

MD5
d1aa534468f7c439a5f027053bb675de

SHA1
4270590bd9991d2436b30156a1b5d1fd4592cf61

SHA256
869b90c7caa3cf0524f611a2fb5661f3a7debc2730f10af82b043969c2299178

SHA512
3add5a4dda2a5aa9cb297b0d38e0afa8bf695f80f05786c251d5e43ebdc6c99a3d488f65385105934a88b3f48c9e950e918190ccbdf8f4a530480f76e435b44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat

Filesize
210B

MD5
cfe2b79c561632254b4ab83079d66ba8

SHA1
1e1a21a4a4695cf761a7d5d7bc973dad165d4317

SHA256
a3d53d229e40c43e5e8de82b9e738cb8112aefd2720fc1b4e5a24585b5d7e379

SHA512
8c2805764d6f72b1a3f05af4eac48001e90d6bf49021742fd59b2571f460d5a97b60bb29544643641686b33177fed6713eee5c85046dd5aaa9a9dcf348590eb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IUuBYBwkQ5.bat

Filesize
210B

MD5
843193e4d75c2f7924d016f60ffe44cb

SHA1
3bec99b7de9068055f068842b4b697c6231b1049

SHA256
5a8c05bc874110f494e7dec1dc9899c0192cd9da641d2eed56e864e5438159d6

SHA512
e810ab0fcae24792d3aaa40989e60f9ca5aef0f7dbc352a870d6bd228d6e81b67e87b9ff59b2edd28dddd481dfcd3c8c1e261f97bcadfdae25806921e90b8cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\h6oaLUsZTY.bat

Filesize
210B

MD5
dc438fac7a3cb721eaec998ccdf9984a

SHA1
a3e00d5288117f08aab5189466eab96706704448

SHA256
024b655d4ee9f57583addba0ed383bad07bb506db28c0b32cd0e363e01ffc59c

SHA512
f4ce39e1dffe434cb72f243123e41d37a8043773acac3690a4c149a5e9f1a8173df40d69dad171444f61df902a32830e895338fcf13f9257231b8de896e79012

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwHeC7tSxv.bat

Filesize
210B

MD5
b20cf0e16d80c0691d1e9ee9350c1f3b

SHA1
93824e801c65e95257dc3e79bca7a304f7d0c81e

SHA256
d47c050ad6201489ee304406a33564f03efc8c997b8d144759a6a780acf0cc93

SHA512
b62d1db7438e082b5a9f89e6759967ee10f3618686f924b9744662d93c3d91f0641b763ab122d6dbc064010168070505416e3f44819fa445f73c31cc56d926d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat

Filesize
210B

MD5
944d8b1ffc9fafc7c01c28ee2a77ed09

SHA1
264dbcf8b7d2c43a0aa3ddb4b8f4060c2071a7a7

SHA256
4fc8e66f5dba64588eedb999f74cfc14bf413b5a7089a6c1043b553c33763609

SHA512
914cac05bdfd3cc1fdcf2e759fc8d87aea679318411da462521577e155d45df094560ea992272625f7be1fe26208265ee8dbc1f7398be62dbbe2143295cb5a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat

Filesize
210B

MD5
944d8b1ffc9fafc7c01c28ee2a77ed09

SHA1
264dbcf8b7d2c43a0aa3ddb4b8f4060c2071a7a7

SHA256
4fc8e66f5dba64588eedb999f74cfc14bf413b5a7089a6c1043b553c33763609

SHA512
914cac05bdfd3cc1fdcf2e759fc8d87aea679318411da462521577e155d45df094560ea992272625f7be1fe26208265ee8dbc1f7398be62dbbe2143295cb5a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat

Filesize
210B

MD5
f3141c5fc9ff3c2dd38d5d059b21b9b6

SHA1
44c2e20b2d9caef0b0f83abd1f825d87c0c279bd

SHA256
133268542be345f5bbb5ab047122997847610768c56c9d8ca2ae55f20e6661af

SHA512
eb61ce6d6c66aeb516f0a817b340c8e20ab20d897f6ca92bc61bc237319313a004a522b5a6e0afe458d1bb54ec96a5b01caa072f78eeddb37f36b61364d6c540

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\schemas\CodeIntegrity\SearchUI.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1748-151-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-149-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-165-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-166-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-167-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-168-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-169-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-170-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-171-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-173-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-172-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-174-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-175-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-176-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-177-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-178-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-179-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-180-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-181-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-182-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-183-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-121-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-122-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-163-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-162-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-161-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-160-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-123-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-159-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-158-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-157-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-125-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-156-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-155-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-154-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-153-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-152-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-126-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-120-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-150-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-164-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-128-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-129-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-148-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-147-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-130-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-146-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-145-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-144-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-143-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-142-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-141-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-139-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-140-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-138-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-137-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-131-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-136-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-135-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-134-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-133-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1748-132-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3112-561-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Filesize
72KB

Download
memory/3384-535-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download
memory/3868-322-0x000001EAE8CF0000-0x000001EAE8D12000-memory.dmp

Filesize
136KB

Download
memory/4528-186-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/4528-185-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/4584-328-0x00000262757B0000-0x0000026275826000-memory.dmp

Filesize
472KB

Download
memory/5044-287-0x0000000002E10000-0x0000000002E22000-memory.dmp

Filesize
72KB

Download
memory/5044-286-0x0000000000BB0000-0x0000000000CC0000-memory.dmp

Filesize
1.1MB

Download
memory/5044-288-0x0000000002E20000-0x0000000002E2C000-memory.dmp

Filesize
48KB

Download
memory/5044-289-0x000000001C060000-0x000000001C06C000-memory.dmp

Filesize
48KB

Download
memory/5044-290-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Filesize
48KB

Download