dcrat | b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0

Analysis

max time kernel
150s
max time network
143s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
05/11/2022, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe
Size

1.3MB
MD5

30e8f1a07f3663cded2ea46a34fd063f
SHA1

67c4fa8d0cbae50099219a10ce1015b88f92b8a6
SHA256

b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0
SHA512

2ab88535c6e7da97c9f40eb2f5c4dc36100323c8dc0ded290e7ab4886f2e4e41225579d656198af590699090258987f611ac3053f9138e946c3c0f51d933f400
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	96	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	796	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	796	schtasks.exe	70

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000001ac19-284.dat	dcrat
behavioral1/files/0x000900000001ac19-285.dat	dcrat
behavioral1/memory/4860-286-0x00000000006A0000-0x00000000007B0000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac30-789.dat	dcrat
behavioral1/files/0x000600000001ac30-788.dat	dcrat
behavioral1/files/0x000600000001ac30-1042.dat	dcrat
behavioral1/files/0x000600000001ac30-1049.dat	dcrat
behavioral1/files/0x000600000001ac30-1055.dat	dcrat
behavioral1/files/0x000600000001ac30-1061.dat	dcrat
behavioral1/files/0x000600000001ac30-1067.dat	dcrat
behavioral1/files/0x000600000001ac30-1073.dat	dcrat
behavioral1/files/0x000600000001ac30-1078.dat	dcrat
behavioral1/files/0x000600000001ac30-1083.dat	dcrat
behavioral1/files/0x000600000001ac30-1088.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
4860	DllCommonsvc.exe
5188	fontdrvhost.exe
844	fontdrvhost.exe
5704	fontdrvhost.exe
96	fontdrvhost.exe
976	fontdrvhost.exe
4052	fontdrvhost.exe
4836	fontdrvhost.exe
1956	fontdrvhost.exe
5760	fontdrvhost.exe
6008	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\es-ES\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\fr-FR\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\fr-FR\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\AppxMetadata\wininit.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SKB\LanguageModels\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\SKB\LanguageModels\7a0fd90576e088	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
696	schtasks.exe
3364	schtasks.exe
4048	schtasks.exe
4596	schtasks.exe
3116	schtasks.exe
2408	schtasks.exe
4356	schtasks.exe
5088	schtasks.exe
5000	schtasks.exe
4376	schtasks.exe
4764	schtasks.exe
4040	schtasks.exe
3188	schtasks.exe
4772	schtasks.exe
3368	schtasks.exe
4036	schtasks.exe
5084	schtasks.exe
220	schtasks.exe
4804	schtasks.exe
4636	schtasks.exe
3984	schtasks.exe
2756	schtasks.exe
4644	schtasks.exe
712	schtasks.exe
3160	schtasks.exe
4708	schtasks.exe
4548	schtasks.exe
4484	schtasks.exe
2328	schtasks.exe
1320	schtasks.exe
4088	schtasks.exe
3824	schtasks.exe
2276	schtasks.exe
4496	schtasks.exe
4756	schtasks.exe
96	schtasks.exe
4740	schtasks.exe
4732	schtasks.exe
844	schtasks.exe
4776	schtasks.exe
4720	schtasks.exe
3244	schtasks.exe
1516	schtasks.exe
4092	schtasks.exe
3088	schtasks.exe
3624	schtasks.exe
4752	schtasks.exe
660	schtasks.exe
4936	schtasks.exe
4624	schtasks.exe
2888	schtasks.exe
4852	schtasks.exe
5068	schtasks.exe
4576	schtasks.exe
4472	schtasks.exe
4540	schtasks.exe
4228	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	fontdrvhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
4860	DllCommonsvc.exe
1292	powershell.exe
1292	powershell.exe
1824	powershell.exe
1824	powershell.exe
2736	powershell.exe
2736	powershell.exe
1168	powershell.exe
1168	powershell.exe
2028	powershell.exe
2028	powershell.exe
3580	powershell.exe
3580	powershell.exe
2512	powershell.exe
2512	powershell.exe
1756	powershell.exe
1756	powershell.exe
4020	powershell.exe
4020	powershell.exe
3756	powershell.exe
3756	powershell.exe
2108	powershell.exe
2108	powershell.exe
4844	powershell.exe
4844	powershell.exe
1684	powershell.exe
1684	powershell.exe
2820	powershell.exe
2820	powershell.exe
4940	powershell.exe
4940	powershell.exe
764	powershell.exe
764	powershell.exe
4432	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	DllCommonsvc.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeIncreaseQuotaPrivilege	5112	powershell.exe
Token: SeSecurityPrivilege	5112	powershell.exe
Token: SeTakeOwnershipPrivilege	5112	powershell.exe
Token: SeLoadDriverPrivilege	5112	powershell.exe
Token: SeSystemProfilePrivilege	5112	powershell.exe
Token: SeSystemtimePrivilege	5112	powershell.exe
Token: SeProfSingleProcessPrivilege	5112	powershell.exe
Token: SeIncBasePriorityPrivilege	5112	powershell.exe
Token: SeCreatePagefilePrivilege	5112	powershell.exe
Token: SeBackupPrivilege	5112	powershell.exe
Token: SeRestorePrivilege	5112	powershell.exe
Token: SeShutdownPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeSystemEnvironmentPrivilege	5112	powershell.exe
Token: SeRemoteShutdownPrivilege	5112	powershell.exe
Token: SeUndockPrivilege	5112	powershell.exe
Token: SeManageVolumePrivilege	5112	powershell.exe
Token: 33	5112	powershell.exe
Token: 34	5112	powershell.exe
Token: 35	5112	powershell.exe
Token: 36	5112	powershell.exe
Token: SeIncreaseQuotaPrivilege	764	powershell.exe
Token: SeSecurityPrivilege	764	powershell.exe
Token: SeTakeOwnershipPrivilege	764	powershell.exe
Token: SeLoadDriverPrivilege	764	powershell.exe
Token: SeSystemProfilePrivilege	764	powershell.exe
Token: SeSystemtimePrivilege	764	powershell.exe
Token: SeProfSingleProcessPrivilege	764	powershell.exe
Token: SeIncBasePriorityPrivilege	764	powershell.exe
Token: SeCreatePagefilePrivilege	764	powershell.exe
Token: SeBackupPrivilege	764	powershell.exe
Token: SeRestorePrivilege	764	powershell.exe
Token: SeShutdownPrivilege	764	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeSystemEnvironmentPrivilege	764	powershell.exe
Token: SeRemoteShutdownPrivilege	764	powershell.exe
Token: SeUndockPrivilege	764	powershell.exe
Token: SeManageVolumePrivilege	764	powershell.exe
Token: 33	764	powershell.exe
Token: 34	764	powershell.exe
Token: 35	764	powershell.exe
Token: 36	764	powershell.exe
Token: SeIncreaseQuotaPrivilege	1168	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4828	1680	b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe	66
PID 1680 wrote to memory of 4828	1680	b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe	66
PID 1680 wrote to memory of 4828	1680	b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe	66
PID 4828 wrote to memory of 1240	4828	WScript.exe	67
PID 4828 wrote to memory of 1240	4828	WScript.exe	67
PID 4828 wrote to memory of 1240	4828	WScript.exe	67
PID 1240 wrote to memory of 4860	1240	cmd.exe	69
PID 1240 wrote to memory of 4860	1240	cmd.exe	69
PID 4860 wrote to memory of 1292	4860	DllCommonsvc.exe	128
PID 4860 wrote to memory of 1292	4860	DllCommonsvc.exe	128
PID 4860 wrote to memory of 1168	4860	DllCommonsvc.exe	129
PID 4860 wrote to memory of 1168	4860	DllCommonsvc.exe	129
PID 4860 wrote to memory of 4020	4860	DllCommonsvc.exe	130
PID 4860 wrote to memory of 4020	4860	DllCommonsvc.exe	130
PID 4860 wrote to memory of 1824	4860	DllCommonsvc.exe	132
PID 4860 wrote to memory of 1824	4860	DllCommonsvc.exe	132
PID 4860 wrote to memory of 2028	4860	DllCommonsvc.exe	134
PID 4860 wrote to memory of 2028	4860	DllCommonsvc.exe	134
PID 4860 wrote to memory of 2108	4860	DllCommonsvc.exe	135
PID 4860 wrote to memory of 2108	4860	DllCommonsvc.exe	135
PID 4860 wrote to memory of 2512	4860	DllCommonsvc.exe	136
PID 4860 wrote to memory of 2512	4860	DllCommonsvc.exe	136
PID 4860 wrote to memory of 2736	4860	DllCommonsvc.exe	137
PID 4860 wrote to memory of 2736	4860	DllCommonsvc.exe	137
PID 4860 wrote to memory of 2820	4860	DllCommonsvc.exe	142
PID 4860 wrote to memory of 2820	4860	DllCommonsvc.exe	142
PID 4860 wrote to memory of 3580	4860	DllCommonsvc.exe	143
PID 4860 wrote to memory of 3580	4860	DllCommonsvc.exe	143
PID 4860 wrote to memory of 4844	4860	DllCommonsvc.exe	149
PID 4860 wrote to memory of 4844	4860	DllCommonsvc.exe	149
PID 4860 wrote to memory of 1684	4860	DllCommonsvc.exe	147
PID 4860 wrote to memory of 1684	4860	DllCommonsvc.exe	147
PID 4860 wrote to memory of 1756	4860	DllCommonsvc.exe	150
PID 4860 wrote to memory of 1756	4860	DllCommonsvc.exe	150
PID 4860 wrote to memory of 3756	4860	DllCommonsvc.exe	151
PID 4860 wrote to memory of 3756	4860	DllCommonsvc.exe	151
PID 4860 wrote to memory of 2936	4860	DllCommonsvc.exe	152
PID 4860 wrote to memory of 2936	4860	DllCommonsvc.exe	152
PID 4860 wrote to memory of 4940	4860	DllCommonsvc.exe	157
PID 4860 wrote to memory of 4940	4860	DllCommonsvc.exe	157
PID 4860 wrote to memory of 4432	4860	DllCommonsvc.exe	158
PID 4860 wrote to memory of 4432	4860	DllCommonsvc.exe	158
PID 4860 wrote to memory of 1004	4860	DllCommonsvc.exe	160
PID 4860 wrote to memory of 1004	4860	DllCommonsvc.exe	160
PID 4860 wrote to memory of 764	4860	DllCommonsvc.exe	163
PID 4860 wrote to memory of 764	4860	DllCommonsvc.exe	163
PID 4860 wrote to memory of 5112	4860	DllCommonsvc.exe	165
PID 4860 wrote to memory of 5112	4860	DllCommonsvc.exe	165
PID 4860 wrote to memory of 2296	4860	DllCommonsvc.exe	168
PID 4860 wrote to memory of 2296	4860	DllCommonsvc.exe	168
PID 2296 wrote to memory of 3368	2296	cmd.exe	170
PID 2296 wrote to memory of 3368	2296	cmd.exe	170
PID 2296 wrote to memory of 5188	2296	cmd.exe	172
PID 2296 wrote to memory of 5188	2296	cmd.exe	172
PID 5188 wrote to memory of 5840	5188	fontdrvhost.exe	173
PID 5188 wrote to memory of 5840	5188	fontdrvhost.exe	173
PID 5840 wrote to memory of 5124	5840	cmd.exe	175
PID 5840 wrote to memory of 5124	5840	cmd.exe	175
PID 5840 wrote to memory of 844	5840	cmd.exe	176
PID 5840 wrote to memory of 844	5840	cmd.exe	176
PID 844 wrote to memory of 5568	844	fontdrvhost.exe	177
PID 844 wrote to memory of 5568	844	fontdrvhost.exe	177
PID 5568 wrote to memory of 5632	5568	cmd.exe	179
PID 5568 wrote to memory of 5632	5568	cmd.exe	179

C:\Users\Admin\AppData\Local\Temp\b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe
"C:\Users\Admin\AppData\Local\Temp\b13b9b77e8ed52a14d29c1f95fc43e9d44772ffcd9555d6d9c7d688232f6bfb0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\fr-FR\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\LanguageModels\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\csrss.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\OfficeClickToRun.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\explorer.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iI4uXNnpwu.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2296
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3368
      - C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VG36Hwy0Lv.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:5124
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5632
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
        11⤵
        
        PID:4636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4024
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:96
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QRlBHoY6P9.bat"
        13⤵
        
        PID:5880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4608
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat"
        15⤵
        
        PID:5940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4584
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat"
        17⤵
        
        PID:5104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:5320
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat"
        19⤵
        
        PID:4020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4400
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat"
        21⤵
        
        PID:5724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4824
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat"
        23⤵
        
        PID:2176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4296
        
        C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
        24⤵
        Executes dropped EXE
        
        PID:6008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Public\Downloads\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\fr-FR\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\fr-FR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\fr-FR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Templates\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\NetHood\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:96

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e482f5d18ff70bc955bcfdf5d0a9659

SHA1
1bb76eb167fd628d4efa59e6fa55babb59a2d0bf

SHA256
ac6586b435c10b2a2931477bf12a42cf9f71208a7321095ec1eed3e9e26fb99a

SHA512
a49a86619009dc9bc1ab9d9b2f7904cc8c243f32ea49540b5641f19db409647a029a1ab8fc7e31df0b95e37438860d4ea992fbe6c7cea2561b5e35bdbdf8c074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e482f5d18ff70bc955bcfdf5d0a9659

SHA1
1bb76eb167fd628d4efa59e6fa55babb59a2d0bf

SHA256
ac6586b435c10b2a2931477bf12a42cf9f71208a7321095ec1eed3e9e26fb99a

SHA512
a49a86619009dc9bc1ab9d9b2f7904cc8c243f32ea49540b5641f19db409647a029a1ab8fc7e31df0b95e37438860d4ea992fbe6c7cea2561b5e35bdbdf8c074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a28f0bf547dd6a06bd54d97529257f3c

SHA1
7f4feb800e823c5df4d313fde17abf48fb34a7e6

SHA256
0cb01926ea1d27df810727c8fecc9862b59b3a68ddadf3659d43a288d9c8c6ad

SHA512
c698ad57fb9260e6071a2e99d7cbe880e5757e0da69064a158aaf1a7c03967a1ffa6e3c0d72431e48c90d3b4f33654a4d49b46deb8e893c3c229284110ba9cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
543be216d171b41e80284edc262ff388

SHA1
f73c4fce22baa18a6186aadc13663cb9d092db87

SHA256
13bc1f1d9cc3fb77d97aafb2ac4038fc6d1072bf947766efeeec4a1204807a75

SHA512
e178c2d9b947244cd449591b56b72f178b4a2043828562262db56e2e7e8aac59e6cd1ab2ddfe4cf7aaca2f7b050c61d0f4025594dcff3422821d3984c1727598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
543be216d171b41e80284edc262ff388

SHA1
f73c4fce22baa18a6186aadc13663cb9d092db87

SHA256
13bc1f1d9cc3fb77d97aafb2ac4038fc6d1072bf947766efeeec4a1204807a75

SHA512
e178c2d9b947244cd449591b56b72f178b4a2043828562262db56e2e7e8aac59e6cd1ab2ddfe4cf7aaca2f7b050c61d0f4025594dcff3422821d3984c1727598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2abaa3acf94347b200007ca42776e9de

SHA1
6d3e92e5ff995bd796c346a840b1a97a20dddf53

SHA256
4a68765b296dfa75419a7a6e08d6c948e01d768c37efc218a2c7e847cb36b61c

SHA512
8c768adc075696c314430e7d06a8dad6348029881a1ca6780c2aa05478b38392e6135e19bb2914ff07a040d9f61d066ad5998f423674908ece595e0e6aa3f34f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
92fe93503a034e0d14274b069869276a

SHA1
d46e8e47538119562f5aaa6e9a1ccfb9084c8de8

SHA256
bb54c6654a2b74d86cd6d6cae4a2a83d27ec036b402066aa5c675de3bcfaab77

SHA512
3e9280ddc19c26b479f52bd07c7e446f7e583db529b639b4bd3942670c850d4d447bb02a0512edaebd346a75a4d55778b072ac6f52c147c239df8ea1870cede8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
92fe93503a034e0d14274b069869276a

SHA1
d46e8e47538119562f5aaa6e9a1ccfb9084c8de8

SHA256
bb54c6654a2b74d86cd6d6cae4a2a83d27ec036b402066aa5c675de3bcfaab77

SHA512
3e9280ddc19c26b479f52bd07c7e446f7e583db529b639b4bd3942670c850d4d447bb02a0512edaebd346a75a4d55778b072ac6f52c147c239df8ea1870cede8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2b100cfbe0ef590523230f95bfe20d7

SHA1
8d41cddffe61e9b87e36ad08acd7daa1fc029ccc

SHA256
0525e19834cc8065cb951b124c31ddb7d8b21469cb271e55ccd77dadd989a823

SHA512
95f78adbffc4320850266a9b887df60b29b8fad025222fb617fca39f4123f68e738d1c26b19d7e35fa64d726851250f4779f0c83572cb38c2602eede0453457f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2b100cfbe0ef590523230f95bfe20d7

SHA1
8d41cddffe61e9b87e36ad08acd7daa1fc029ccc

SHA256
0525e19834cc8065cb951b124c31ddb7d8b21469cb271e55ccd77dadd989a823

SHA512
95f78adbffc4320850266a9b887df60b29b8fad025222fb617fca39f4123f68e738d1c26b19d7e35fa64d726851250f4779f0c83572cb38c2602eede0453457f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8418e48638193061e0028b40ccaa1eff

SHA1
88f18d9ad82af3be042c5dd8dd1368b376a0e2d9

SHA256
8855a0428d6cae7277a1a455b1ac3989a4364feda6a722ee424fe7bd08af146f

SHA512
b195eff9f5fbf8edb3bc056866546f5ebf32aa032b74b178b7f8f1533f3644ca7a6e4fc956140172c26e9a65e3485df5675498c5c28ee891d45c0275c95989bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
11b734f369557d91e2eae9f5fcf5e6d4

SHA1
107fd0f99d97b6d90b5b0d533e8273a0a8fa23f2

SHA256
1842ff456116b384f59e48800aec01716270dbbb351baae4e439b1f8232361e4

SHA512
ddf0103777ccf071cb8db5524251d13a8073f88d00bd8a8be66249bed19c3f327bba37f8ff007452f46474b19f12d9e70f4a0eeadda93833cfa35782ebb9f5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
11b734f369557d91e2eae9f5fcf5e6d4

SHA1
107fd0f99d97b6d90b5b0d533e8273a0a8fa23f2

SHA256
1842ff456116b384f59e48800aec01716270dbbb351baae4e439b1f8232361e4

SHA512
ddf0103777ccf071cb8db5524251d13a8073f88d00bd8a8be66249bed19c3f327bba37f8ff007452f46474b19f12d9e70f4a0eeadda93833cfa35782ebb9f5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
381d0c915dd666e3356b0d544fa43d4b

SHA1
6acaa7c4cef48f914355daf346d4ffb23f241fde

SHA256
136362217008fb728e6633068864c3cfb2584d43e149209a404cfc1789506b70

SHA512
b512677b6a04357af63a818eb5b753735b1931efdab48f15d270ed18cea2e17d01010461d01dec6c54c9315d7fb94a7fddde50598bed330de01f9183801eeb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dd5c73854170cdd28f20dfa46b555184

SHA1
9e5ee015c05627feef7e6a3b59ae315d825c2522

SHA256
5aadd5685570e89248466e1e34bdd582361e31a1d9f580e5dfae6af748c1b980

SHA512
be86d966908c8bc95bd6275a67e11a4c726ad6178481e9370af885ce0f04f0554a857302168ff10bd6cbfe79963b81e1c8efac8b82d50e7cd5c1267fb606078f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dd5c73854170cdd28f20dfa46b555184

SHA1
9e5ee015c05627feef7e6a3b59ae315d825c2522

SHA256
5aadd5685570e89248466e1e34bdd582361e31a1d9f580e5dfae6af748c1b980

SHA512
be86d966908c8bc95bd6275a67e11a4c726ad6178481e9370af885ce0f04f0554a857302168ff10bd6cbfe79963b81e1c8efac8b82d50e7cd5c1267fb606078f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
36962d1845c5737bef16a94b32634316

SHA1
7b408a4474c3cb1e4fa0d347a88378888d48e9ca

SHA256
19eed8e15c1febf4a5cb88735864605a3c5237fc24f019cebcb1ff019caeba1b

SHA512
554818297304c316f53c9bd3465092836b626663a3bdd8477324b78a5a5b26908075aae12b2f55a133aa6e8a8d706b8c244444cc08d353b226b85c4da6e3aef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
595f6c2eb212475a64178cb63bb4f839

SHA1
33522acc3292606fe952e9cbea818b8e3f1f3cd6

SHA256
0b51770148d449968e5a3656b0b1609871c0e4668aab6a6760fa333b64ce2418

SHA512
7cea06f4499f1b41b7d24ae827870f512a5d2c9ce0ab2e67b0571f0e385d4e7288f41ee8f56949cdfb426315c41b0106a5bb3c56d9f312b706d1a7403e8c198b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
240B

MD5
18839b8f73cd21ef031c3e8d69fae463

SHA1
64e062ea55cb32940dbc997ebd989e934c862178

SHA256
4b7c846d41a0c7e7359685b9b9af504181ae6912abbf3a0d7c8457a320e9203a

SHA512
fcbc6c507257d8ac912c2b3a4271fac21ebefdcfa58ca4a723335c7c012899f71c89a1f0fdcf75cc4824bf4295bfd1e67814652afa8c43b743ffd597030173f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat

Filesize
231B

MD5
371d6a7dd8901be4575abc2c9fb98ef3

SHA1
0725654e8aaf4594994b561ef23f8b8ba8e616ed

SHA256
435d3108f655028911e2f426d856270d78977aee0465d3c17857966f22ec4fa9

SHA512
901f87129ac0f04aad02ad0287d22e8f4b5f9f05d51a5b220c41fef4ad9194701e263f2865a73c81a614156678fefdd7585cd46e61689cfa96aa7e897e8a2730

Download Submit
C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat

Filesize
231B

MD5
842138f8160e35eabe2810d442e216dd

SHA1
f3907ca64c504356830cd3ae5ce38087c12d02d0

SHA256
54807f5c5043084fa9d1974d9577b8ea4ca54860405537e515e5801ccc12a672

SHA512
12a1ee1685cf5b0371e44235c56a1bd01c4c85254072438e541c79f62bc9eddfbf3f88a1cf00a4957f5552d76bd90fc1fc09d02da8f6986883964872a9045520

Download Submit
C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat

Filesize
231B

MD5
5733403fe0ac876da99afae513d283c4

SHA1
2a0ed05ea6414bfe7efd2c6f852e85d781fb99ac

SHA256
b7526e5d189e40c0326e72d6e00b83285c63ba4d9927542d32b8f6c6e26ffc79

SHA512
41318716acc8f5052e8d8879fd29f60128cbca0cba2d67fdea5970524e5cfff030e6c1c449bf54ec74373291fbbcbdc175fb7b334a405b445fe0770d5fbda8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat

Filesize
231B

MD5
03c35c26ea7e6736bbd4633d613106a1

SHA1
fba7f33df468393af5480eaf9529d603e7fcf226

SHA256
177717e07ae5693d6bb19841362cf1118eb503fc32d91cf4749615737cd727f7

SHA512
146a7a79e723bbcc05761ffb67ed596c2a9e17de7e36e081317c728f8f86f6bc15fea3dcd6fb6122f8f0dc7e70af9c3b1b9ace7c50921909cb0ab11524b1ffad

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRlBHoY6P9.bat

Filesize
231B

MD5
20d0176aefe79959bcaa660502a77488

SHA1
6ce3007508ecd5853c2e1e31eae45c72907c6102

SHA256
558bd58ab7a6b28af1a222ef8085acbb8be3327b896b8b621f51ccd52e5d5f94

SHA512
ed3fabe6e8d7f27e32b0df87ae53602f1123a98258418e27e0a186ffcb3e1749dbd622e0209ac0b4f1799bcd8e15d4c6d48eaf2d197dbd8a6d7603a5b07f4e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\VG36Hwy0Lv.bat

Filesize
231B

MD5
672eeae3409c22ba79d76b95b67f60fc

SHA1
e67d8b741bc04df401a8fad270f161c201efb4d8

SHA256
8b0d0ea8de47bda4e8a932e1422cecac2becacaae2f24199e548959d956b0f6e

SHA512
21f2183bb4d946dcd673f7fca8386b8d544ffb8e643c4408bd2a5ae15d0864300151f98c422fb1c6e2d7e64b41c90df28b6a88744a43b517193bb2acf50be77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat

Filesize
231B

MD5
a20c02b2431d6b377fd3b82654090770

SHA1
e50f3cd118f3d94089570681d719df51ca278e17

SHA256
d7706a7cd0e508abe3b3632dc423be362874a2ba12dc146d56dba936a1aa1ba8

SHA512
1fe1e37df0ee241897ae0cee78e90a1fe6afa4da677d9671717f53be359e1cb8a97aad92168ee2863351640f86ae58c86f6befe9d93583ba60fa6c08c81d3301

Download Submit
C:\Users\Admin\AppData\Local\Temp\iI4uXNnpwu.bat

Filesize
231B

MD5
51780554d74d7883652ad0bf1b967040

SHA1
16f80ab0f03677dcbea8bffab127a48dc7de18d6

SHA256
239c5a653d27f49320480c8c4cd0d0b4a2782edb36215b7387ff43b74fa12ef5

SHA512
2fc971fbe2828678732900ef31aea4b5d3e8625901279c86e2e1ee50e6dc48f7f4f7ef6123d1c9044ff272fd46af7e8d566df738378a13eed6ef67a57c893f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

Filesize
231B

MD5
a2fd6f036946b22116e81068b5d12cd9

SHA1
1a3a3f7776e63fd257b9b769d8cebfc8ad806206

SHA256
eddf8161ffcfe47b6a942dc7f5b5924558f749bf8250fb11a943d5bdfe0953e3

SHA512
3419d447d8738cf19212eaeeda66ec90b1e6e3a1d2fcb3bf0eeb7002f47985cb8dc1d944dc036cd7012b182c64d9b152454cb9b83d5672eee61528399aab1cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat

Filesize
231B

MD5
cfeee11a28e2115901638c42c1bb3252

SHA1
c99987d7c52dd495fa791821e6e3085f24862f77

SHA256
33d1342319e7af3f91ebdbb70a188daa991d85c06a475fe34da75810cfce74bc

SHA512
ea289710c910f49c44c5995e8e63b7c56bebd7e8b51f22d4568cb102c79633f9a73f00a3bfccb1d7b5ae27c772b0f19be0831dee77110a1c285f7bf2c7f0cb7b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/96-1056-0x0000000001460000-0x0000000001472000-memory.dmp

Filesize
72KB

Download
memory/844-1044-0x0000000000B90000-0x0000000000BA2000-memory.dmp

Filesize
72KB

Download
memory/976-1062-0x0000000000860000-0x0000000000872000-memory.dmp

Filesize
72KB

Download
memory/1168-378-0x000001D24CEB0000-0x000001D24CED2000-memory.dmp

Filesize
136KB

Download
memory/1680-152-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-154-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-182-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-183-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-180-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-179-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-178-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-177-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-176-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-175-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-174-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-173-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-172-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-170-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-171-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-169-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-168-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-167-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-166-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-165-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-164-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-163-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-162-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-161-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-160-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-159-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-158-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-157-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-156-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-155-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-120-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-121-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-181-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-153-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-151-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-150-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-149-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-148-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-147-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-146-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-145-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-144-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-143-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-142-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-141-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-140-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-139-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-138-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-137-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-136-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-135-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-134-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-133-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-132-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-131-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-130-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-129-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-128-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-126-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-125-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-123-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-122-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/4052-1068-0x00000000012E0000-0x00000000012F2000-memory.dmp

Filesize
72KB

Download
memory/4828-185-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/4828-186-0x0000000077390000-0x000000007751E000-memory.dmp

Filesize
1.6MB

Download
memory/4860-289-0x000000001B310000-0x000000001B31C000-memory.dmp

Filesize
48KB

Download
memory/4860-290-0x000000001B320000-0x000000001B32C000-memory.dmp

Filesize
48KB

Download
memory/4860-288-0x000000001B300000-0x000000001B30C000-memory.dmp

Filesize
48KB

Download
memory/4860-287-0x000000001B2F0000-0x000000001B302000-memory.dmp

Filesize
72KB

Download
memory/4860-286-0x00000000006A0000-0x00000000007B0000-memory.dmp

Filesize
1.1MB

Download
memory/5112-420-0x00000280FAAE0000-0x00000280FAB56000-memory.dmp

Filesize
472KB

Download
memory/5704-1050-0x0000000000720000-0x0000000000732000-memory.dmp

Filesize
72KB

Download
memory/6008-1089-0x0000000002C20000-0x0000000002C32000-memory.dmp

Filesize
72KB

Download