Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 13:09
Behavioral task
behavioral1
Sample
e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe
Resource
win10v2004-20220901-en
General
-
Target
e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe
-
Size
1.3MB
-
MD5
d73d8d09afca8210b99f92f0b0bf8c62
-
SHA1
40e4c96ab5086e1facc1054841b5514bd7327f7e
-
SHA256
e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a
-
SHA512
36fbfbf43e061fa8ec9a61edb8f760c97e1261b2abaed2eace1094c5ae2f0d3026c3f2bd131d080b2749dfc89db03615f5491268690345b2232bd9e484a3774c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4744 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3492 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2264 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4252 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3816 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1092 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2312 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2344 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1004 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4580 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1632 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3628 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4408 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1776 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4916 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3524 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2384 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3920 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4292 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 396 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3180 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4244 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2088 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 2936 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4068 2936 schtasks.exe -
Processes:
resource yara_rule C:\providercommon\DllCommonsvc.exe dcrat C:\providercommon\DllCommonsvc.exe dcrat behavioral1/memory/2212-139-0x0000000000B60000-0x0000000000C70000-memory.dmp dcrat C:\providercommon\DllCommonsvc.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat C:\odt\WaaSMedicAgent.exe dcrat -
Executes dropped EXE 13 IoCs
Processes:
DllCommonsvc.exeDllCommonsvc.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exepid process 2212 DllCommonsvc.exe 2304 DllCommonsvc.exe 3228 WaaSMedicAgent.exe 4760 WaaSMedicAgent.exe 4504 WaaSMedicAgent.exe 2408 WaaSMedicAgent.exe 3016 WaaSMedicAgent.exe 2172 WaaSMedicAgent.exe 3564 WaaSMedicAgent.exe 2740 WaaSMedicAgent.exe 3836 WaaSMedicAgent.exe 3316 WaaSMedicAgent.exe 904 WaaSMedicAgent.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeDllCommonsvc.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWScript.exeDllCommonsvc.exeWaaSMedicAgent.exeWaaSMedicAgent.exee4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WaaSMedicAgent.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 13 IoCs
Processes:
DllCommonsvc.exeDllCommonsvc.exedescription ioc process File created C:\Program Files (x86)\WindowsPowerShell\dwm.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\taskhostw.exe DllCommonsvc.exe File created C:\Program Files\Windows Mail\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\defaults\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\6cb0b6c459d5d3 DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Temp\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Temp\cc11b995f2a76d DllCommonsvc.exe File created C:\Program Files\Windows Mail\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files\Mozilla Firefox\defaults\csrss.exe DllCommonsvc.exe -
Drops file in Windows directory 3 IoCs
Processes:
DllCommonsvc.exedescription ioc process File created C:\Windows\RemotePackages\StartMenuExperienceHost.exe DllCommonsvc.exe File opened for modification C:\Windows\RemotePackages\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Windows\RemotePackages\55b276f4edf653 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 628 schtasks.exe 3496 schtasks.exe 4292 schtasks.exe 2124 schtasks.exe 3920 schtasks.exe 4112 schtasks.exe 4252 schtasks.exe 1092 schtasks.exe 3524 schtasks.exe 3180 schtasks.exe 2344 schtasks.exe 1776 schtasks.exe 396 schtasks.exe 1004 schtasks.exe 2088 schtasks.exe 3492 schtasks.exe 4396 schtasks.exe 3816 schtasks.exe 4916 schtasks.exe 2384 schtasks.exe 4068 schtasks.exe 1632 schtasks.exe 3628 schtasks.exe 4408 schtasks.exe 208 schtasks.exe 2312 schtasks.exe 764 schtasks.exe 3096 schtasks.exe 3600 schtasks.exe 4744 schtasks.exe 4580 schtasks.exe 4244 schtasks.exe 4468 schtasks.exe 1664 schtasks.exe 2264 schtasks.exe 1308 schtasks.exe -
Modifies registry class 11 IoCs
Processes:
WaaSMedicAgent.exeWaaSMedicAgent.exee4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeDllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exepid process 2212 DllCommonsvc.exe 2212 DllCommonsvc.exe 2212 DllCommonsvc.exe 2212 DllCommonsvc.exe 2212 DllCommonsvc.exe 1136 powershell.exe 2036 powershell.exe 4268 powershell.exe 3848 powershell.exe 2324 powershell.exe 2304 DllCommonsvc.exe 2036 powershell.exe 1136 powershell.exe 4268 powershell.exe 2324 powershell.exe 3848 powershell.exe 2304 DllCommonsvc.exe 2304 DllCommonsvc.exe 2304 DllCommonsvc.exe 2304 DllCommonsvc.exe 2304 DllCommonsvc.exe 2304 DllCommonsvc.exe 1692 powershell.exe 1692 powershell.exe 4988 powershell.exe 4988 powershell.exe 2368 powershell.exe 2368 powershell.exe 4004 powershell.exe 4004 powershell.exe 4972 powershell.exe 4972 powershell.exe 4264 powershell.exe 4264 powershell.exe 1372 powershell.exe 1372 powershell.exe 2504 powershell.exe 2504 powershell.exe 1664 powershell.exe 1664 powershell.exe 3228 WaaSMedicAgent.exe 3228 WaaSMedicAgent.exe 2368 powershell.exe 4972 powershell.exe 1692 powershell.exe 4988 powershell.exe 4004 powershell.exe 4264 powershell.exe 1372 powershell.exe 2504 powershell.exe 1664 powershell.exe 4760 WaaSMedicAgent.exe 4504 WaaSMedicAgent.exe 2408 WaaSMedicAgent.exe 3016 WaaSMedicAgent.exe 2172 WaaSMedicAgent.exe 3564 WaaSMedicAgent.exe 2740 WaaSMedicAgent.exe 3836 WaaSMedicAgent.exe 3316 WaaSMedicAgent.exe 904 WaaSMedicAgent.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exeDllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exeWaaSMedicAgent.exedescription pid process Token: SeDebugPrivilege 2212 DllCommonsvc.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 4268 powershell.exe Token: SeDebugPrivilege 2036 powershell.exe Token: SeDebugPrivilege 3848 powershell.exe Token: SeDebugPrivilege 2304 DllCommonsvc.exe Token: SeDebugPrivilege 2324 powershell.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeDebugPrivilege 2368 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 4264 powershell.exe Token: SeDebugPrivilege 1372 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeDebugPrivilege 3228 WaaSMedicAgent.exe Token: SeDebugPrivilege 4760 WaaSMedicAgent.exe Token: SeDebugPrivilege 4504 WaaSMedicAgent.exe Token: SeDebugPrivilege 2408 WaaSMedicAgent.exe Token: SeDebugPrivilege 3016 WaaSMedicAgent.exe Token: SeDebugPrivilege 2172 WaaSMedicAgent.exe Token: SeDebugPrivilege 3564 WaaSMedicAgent.exe Token: SeDebugPrivilege 2740 WaaSMedicAgent.exe Token: SeDebugPrivilege 3836 WaaSMedicAgent.exe Token: SeDebugPrivilege 3316 WaaSMedicAgent.exe Token: SeDebugPrivilege 904 WaaSMedicAgent.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exeWScript.execmd.exeDllCommonsvc.exeDllCommonsvc.exeWaaSMedicAgent.execmd.exeWaaSMedicAgent.execmd.exeWaaSMedicAgent.execmd.exeWaaSMedicAgent.execmd.exedescription pid process target process PID 4816 wrote to memory of 4024 4816 e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe WScript.exe PID 4816 wrote to memory of 4024 4816 e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe WScript.exe PID 4816 wrote to memory of 4024 4816 e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe WScript.exe PID 4024 wrote to memory of 2348 4024 WScript.exe cmd.exe PID 4024 wrote to memory of 2348 4024 WScript.exe cmd.exe PID 4024 wrote to memory of 2348 4024 WScript.exe cmd.exe PID 2348 wrote to memory of 2212 2348 cmd.exe DllCommonsvc.exe PID 2348 wrote to memory of 2212 2348 cmd.exe DllCommonsvc.exe PID 2212 wrote to memory of 1136 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 1136 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 3848 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 3848 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 2036 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 2036 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 4268 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 4268 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 2324 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 2324 2212 DllCommonsvc.exe powershell.exe PID 2212 wrote to memory of 2304 2212 DllCommonsvc.exe DllCommonsvc.exe PID 2212 wrote to memory of 2304 2212 DllCommonsvc.exe DllCommonsvc.exe PID 2304 wrote to memory of 4972 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4972 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4988 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4988 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4004 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4004 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 1692 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 1692 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 2368 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 2368 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4264 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 4264 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 1372 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 1372 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 2504 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 2504 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 1664 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 1664 2304 DllCommonsvc.exe powershell.exe PID 2304 wrote to memory of 3228 2304 DllCommonsvc.exe WaaSMedicAgent.exe PID 2304 wrote to memory of 3228 2304 DllCommonsvc.exe WaaSMedicAgent.exe PID 3228 wrote to memory of 3180 3228 WaaSMedicAgent.exe cmd.exe PID 3228 wrote to memory of 3180 3228 WaaSMedicAgent.exe cmd.exe PID 3180 wrote to memory of 2232 3180 cmd.exe w32tm.exe PID 3180 wrote to memory of 2232 3180 cmd.exe w32tm.exe PID 3180 wrote to memory of 4760 3180 cmd.exe WaaSMedicAgent.exe PID 3180 wrote to memory of 4760 3180 cmd.exe WaaSMedicAgent.exe PID 4760 wrote to memory of 956 4760 WaaSMedicAgent.exe cmd.exe PID 4760 wrote to memory of 956 4760 WaaSMedicAgent.exe cmd.exe PID 956 wrote to memory of 3488 956 cmd.exe w32tm.exe PID 956 wrote to memory of 3488 956 cmd.exe w32tm.exe PID 956 wrote to memory of 4504 956 cmd.exe WaaSMedicAgent.exe PID 956 wrote to memory of 4504 956 cmd.exe WaaSMedicAgent.exe PID 4504 wrote to memory of 1588 4504 WaaSMedicAgent.exe cmd.exe PID 4504 wrote to memory of 1588 4504 WaaSMedicAgent.exe cmd.exe PID 1588 wrote to memory of 3108 1588 cmd.exe w32tm.exe PID 1588 wrote to memory of 3108 1588 cmd.exe w32tm.exe PID 1588 wrote to memory of 2408 1588 cmd.exe WaaSMedicAgent.exe PID 1588 wrote to memory of 2408 1588 cmd.exe WaaSMedicAgent.exe PID 2408 wrote to memory of 4984 2408 WaaSMedicAgent.exe cmd.exe PID 2408 wrote to memory of 4984 2408 WaaSMedicAgent.exe cmd.exe PID 4984 wrote to memory of 2020 4984 cmd.exe w32tm.exe PID 4984 wrote to memory of 2020 4984 cmd.exe w32tm.exe PID 4984 wrote to memory of 3016 4984 cmd.exe WaaSMedicAgent.exe PID 4984 wrote to memory of 3016 4984 cmd.exe WaaSMedicAgent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe"C:\Users\Admin\AppData\Local\Temp\e4512e2e73cb16498e242c4f33571214c0da6fe33bf89ab6fa73afd50183659a.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\csrss.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\dwm.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\StartMenuExperienceHost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\StartMenuExperienceHost.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\powershell.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Temp\winlogon.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\RuntimeBroker.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B7rL9EqqPR.bat"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"8⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oVhzrLBDaJ.bat"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"10⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"12⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"15⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"16⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat"17⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"18⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PoOVO2yVWN.bat"19⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"20⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat"21⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"22⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7FnFm4j3ls.bat"23⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"24⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat"25⤵
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵
-
C:\odt\WaaSMedicAgent.exe"C:\odt\WaaSMedicAgent.exe"26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WaaSMedicAgent.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\taskhostw.exe'6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\RemotePackages\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\defaults\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\defaults\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\providercommon\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\odt\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Temp\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Temp\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\odt\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.logFilesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WaaSMedicAgent.exe.logFilesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5cf79136142125a14a0d763b303b2effd
SHA120c496b9c84ddb9c365d6c59823660768c9dfdf7
SHA25638297561076f05a1d94b8c6273098acc6866a563466e6a62e1c75846210715e3
SHA51237e871507b221658b17bc7b1e100a695ed2ddcd5fa39176dc0ee858c7ef78d279699cd493532e1c95774f3b8a869d6a1d8fa3096314ba17025ec0041e2033522
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53505effaead0f06d098f1aec01836881
SHA194bafdbeb2f5adbd8cec709574df5b8dbcc5eba3
SHA2565d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517
SHA512934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53505effaead0f06d098f1aec01836881
SHA194bafdbeb2f5adbd8cec709574df5b8dbcc5eba3
SHA2565d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517
SHA512934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53505effaead0f06d098f1aec01836881
SHA194bafdbeb2f5adbd8cec709574df5b8dbcc5eba3
SHA2565d39a25ff8842c7c14aa14f99c5e3e1606fb7516c57f03dc41069df3c3de0517
SHA512934d8eab5bc2ec20e800c668f3c3434829feade4771918a22d712f7ba39f91f93877a1e9dc1beac966646af0c9dd2cf118041535143b3abc585fea8dfb1299f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bf3651a8682259b5e292b98289271f76
SHA14694a32734c377985dafbd15e26b9a129f1e4a45
SHA2565ffc07abea05b9bb523e511ed75995488a22e3dd54fddc50b62b8336bd57c575
SHA512d9cd369fc710131f0f24c3add83a923625831b1bfb4fba0da83dd71fa41a4ed5a0f0e00755f3cf8ae2aef4aa498c353348c51c167f7d6a2af834f07c78b33896
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5b7b47377bcaba7a045dc11be31f711b3
SHA1c915578f1139e3d0ca94d8ea73a17698771400e8
SHA25623d457e05f8b8fc47e6617fee28d04a7e6fab993751b94514c9308e387c95a1a
SHA512be381612f831f820e7fb04fa94c7a61954f4bba3d1b2d1112e455b41a6e9322b35e75311fbf24d5ff541a73d56bf79976e1462fee06d337341ad0953325636a3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5481c1608c2bec426ca209e8800611abd
SHA15df5a08760b0e5c56cb9daf768894435354d2651
SHA25644e538c7570e175634f9929d350a79203730fcb753638f611a1dd4780ec430ed
SHA5125a87762225beffbd34048fd0d617a75eff25ca6dfe47c258cdfad8c841f8b0b4144ae8c7ef04ee5de36987cb6ae0953499d5fa27b2100483a8042ee5e27d190c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD50d8abf9638c74e2459427f0738f597a0
SHA17f0d7f08e3bab3736388f3db7e5cb5beb726ef4d
SHA256cad3af71b0b153675d87318a3fd44524d95a1b158549e5dd94d64795972d9382
SHA51252e226e566b0b3b3800538c452deccde78ca22fbc47139c34e9f35fc49c2549b44ac4e5c5debc0692251244757af6f2ab447cad4c28fa6a2711661c472ae7b30
-
C:\Users\Admin\AppData\Local\Temp\7FnFm4j3ls.batFilesize
190B
MD5f3fa29b0fd7bd0aa99e9d7095c1306fd
SHA1067e489a0c269a6f39f63f4729d755ed4a69d606
SHA256363085c6856034dbd43f8c0f30e7f1ef83e3a28cba39677e0dc2f5a20e00b53d
SHA512b9f317efa119c0a4b80393f75ce3d9b82ab502cb74353492c3cfe835ac5396c610ff58cf098e989a710c5899b5fbb15aaf8f325896323c0c6aa51a9c56ba9c93
-
C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.batFilesize
190B
MD52a18d8de243dfdb8daf05258432de925
SHA10ea57a4c7e321a462e94c9ab02ff80d32bdd5a43
SHA256deb01a192f7f6fe63d3801620001de6a7ecd65a6e8571a6b5fdbbc9ed5cbeb56
SHA512733684fc5944dc00c0bec057429509f7a4cad35cc28cbd47ab0126579d86efa7fbf0a7302dde8c5604bc779fc1176a73d2fca80201f78353393ac812544031a4
-
C:\Users\Admin\AppData\Local\Temp\B7rL9EqqPR.batFilesize
190B
MD538c2799f222fa2c04c546de14c1b0881
SHA17bf6a42825e04bbfb3ac610da948ea28011152aa
SHA256d89fea063cbcaf808bc758135080fa2dc986ba0bc086a34d23e2bf6a87207dc2
SHA5128745378da229b34b942e2cd2c0747d96f973414a54c933239f3e120b5782ad9a38b6af14f6c1eb4e484ca5369d277bdfaa48e30ce2416982e2310c0638aa26ef
-
C:\Users\Admin\AppData\Local\Temp\PoOVO2yVWN.batFilesize
190B
MD5eca6044f5e7bce49f95f613669d9990b
SHA1291927c2641e8a1932dec214908ae121f84215be
SHA256dce262bf9e9d65d9ccf68708192e0bb16fa956182ef3ba58b86bfb2122428dde
SHA51253b40f677d007d1b3b3658b378c0a7b583faab824728a179863efd8fd3b5ab33d8cdeb167f4f2ab92a52d7728bc28087a579c81657844cda4fec194ac7a704a5
-
C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.batFilesize
190B
MD5a41c0b5ab7ed1c79728a48a99767abea
SHA1e8d2eb12366091b7e046b0b1c45a3000190da8db
SHA2568c7e20324656890b2809b6596ee344e99bc7b3a4559c8d78088d134ff53a8ef8
SHA512cd3798978be81052b9446d7c1e99ac8c87d1dedd275646d725fcd50e3ac3bdbc775f3811008cf0065d061c08d8dbaa6e35d2b1288b81da220278212d198b95e9
-
C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.batFilesize
190B
MD598db700b86716b61c01a2af26527ec4d
SHA1052053af547a2136c02b6437c935ef1e4e5d60f6
SHA256d9a42d13b01feac0d55481df1c1d6b92c9eac27ac887428c138d7d8204ab4836
SHA512d7d4b859b24003940773ac923b31cd2685ac93217871e050aeba550e902bedf317dc023d04e6bbd5f006f21ea315e3b228df638ebe5cee022eea1b0c143fdfac
-
C:\Users\Admin\AppData\Local\Temp\oVhzrLBDaJ.batFilesize
190B
MD533affa242bbcb0e886dc581ad92900b8
SHA1a71a48f304cadf7039f6b95022c725c82f5485ce
SHA256998ca2043be47e1c5cdb0a68e58c0a724609fff5931a25a9020e63b95e9cf42d
SHA512fdf6a7b05715714f1eb3a09adc8607a312ecb25fa0a82f8d5607b006900604fd5681388a411a78e8bcb37d0c176c318edb47d9fd58152ebd1d4478b42aa30d08
-
C:\Users\Admin\AppData\Local\Temp\paq62miIo8.batFilesize
190B
MD59ba568db57451b4dcc91053c8825669d
SHA1214ea97aa05d298541848b7b530e91b46177f3dc
SHA2562d9879f378050d76a1214c9b03e139a0cd17e861f354d6ceaf92ed590ec9c72e
SHA5121c9345df0f9bb607981e65cf4a2987dd4ff373aef336af29799bb58d0fa52a2e7f1295cd92be89ff459e7cd38964153fe6c61854ae868e9a0b45c2add3a8150a
-
C:\Users\Admin\AppData\Local\Temp\paq62miIo8.batFilesize
190B
MD59ba568db57451b4dcc91053c8825669d
SHA1214ea97aa05d298541848b7b530e91b46177f3dc
SHA2562d9879f378050d76a1214c9b03e139a0cd17e861f354d6ceaf92ed590ec9c72e
SHA5121c9345df0f9bb607981e65cf4a2987dd4ff373aef336af29799bb58d0fa52a2e7f1295cd92be89ff459e7cd38964153fe6c61854ae868e9a0b45c2add3a8150a
-
C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.batFilesize
190B
MD55c9b8dd7e0946233286468c9e41f7b97
SHA13f39a6db646fd2d469f0ef6c7fe05a9eb9e4e03c
SHA256ec6b52df99bc59fe5a3dcc453e55b118f0d4f73f9b07ffb1d02304a0c00354c5
SHA5129d4041fa66ee6766b7ed32e0cdc81ee23b4ab8f543c8eb68a77d5a63ffaa7e54269633c73a3b0d9849df4a58332f491955a6f5edc2e86d65c15604733e8f2220
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\odt\WaaSMedicAgent.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\providercommon\1zu9dW.batFilesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
C:\providercommon\DllCommonsvc.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\providercommon\DllCommonsvc.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\providercommon\DllCommonsvc.exeFilesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbeFilesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
-
memory/904-278-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/904-276-0x0000000000000000-mapping.dmp
-
memory/956-216-0x0000000000000000-mapping.dmp
-
memory/1136-165-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1136-148-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1136-141-0x0000000000000000-mapping.dmp
-
memory/1136-152-0x0000020B7FF80000-0x0000020B7FFA2000-memory.dmpFilesize
136KB
-
memory/1372-172-0x0000000000000000-mapping.dmp
-
memory/1372-204-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1372-187-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1504-258-0x0000000000000000-mapping.dmp
-
memory/1588-223-0x0000000000000000-mapping.dmp
-
memory/1664-207-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1664-189-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1664-174-0x0000000000000000-mapping.dmp
-
memory/1692-195-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/1692-169-0x0000000000000000-mapping.dmp
-
memory/1692-183-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2020-232-0x0000000000000000-mapping.dmp
-
memory/2036-154-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2036-161-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2036-143-0x0000000000000000-mapping.dmp
-
memory/2172-241-0x0000000000000000-mapping.dmp
-
memory/2172-247-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2172-243-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2212-140-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2212-150-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2212-139-0x0000000000B60000-0x0000000000C70000-memory.dmpFilesize
1.1MB
-
memory/2212-136-0x0000000000000000-mapping.dmp
-
memory/2232-210-0x0000000000000000-mapping.dmp
-
memory/2304-146-0x0000000000000000-mapping.dmp
-
memory/2304-151-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2304-181-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2324-163-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2324-145-0x0000000000000000-mapping.dmp
-
memory/2324-155-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2348-135-0x0000000000000000-mapping.dmp
-
memory/2368-184-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2368-170-0x0000000000000000-mapping.dmp
-
memory/2368-192-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2408-227-0x0000000000000000-mapping.dmp
-
memory/2408-233-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/2408-229-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/2504-173-0x0000000000000000-mapping.dmp
-
memory/2504-188-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2504-205-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2740-255-0x0000000000000000-mapping.dmp
-
memory/2740-261-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2740-257-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/2748-239-0x0000000000000000-mapping.dmp
-
memory/2844-260-0x0000000000000000-mapping.dmp
-
memory/3016-234-0x0000000000000000-mapping.dmp
-
memory/3016-240-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/3016-236-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/3108-226-0x0000000000000000-mapping.dmp
-
memory/3140-237-0x0000000000000000-mapping.dmp
-
memory/3180-208-0x0000000000000000-mapping.dmp
-
memory/3196-272-0x0000000000000000-mapping.dmp
-
memory/3228-213-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3228-175-0x0000000000000000-mapping.dmp
-
memory/3228-190-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3316-271-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3316-275-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3316-269-0x0000000000000000-mapping.dmp
-
memory/3488-218-0x0000000000000000-mapping.dmp
-
memory/3564-254-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3564-250-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3564-248-0x0000000000000000-mapping.dmp
-
memory/3764-267-0x0000000000000000-mapping.dmp
-
memory/3812-244-0x0000000000000000-mapping.dmp
-
memory/3836-268-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3836-264-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3836-262-0x0000000000000000-mapping.dmp
-
memory/3848-162-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/3848-142-0x0000000000000000-mapping.dmp
-
memory/3848-149-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4004-199-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4004-182-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4004-168-0x0000000000000000-mapping.dmp
-
memory/4024-132-0x0000000000000000-mapping.dmp
-
memory/4196-246-0x0000000000000000-mapping.dmp
-
memory/4264-186-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4264-171-0x0000000000000000-mapping.dmp
-
memory/4264-202-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4268-144-0x0000000000000000-mapping.dmp
-
memory/4268-164-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4268-153-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4400-274-0x0000000000000000-mapping.dmp
-
memory/4504-220-0x0000000000000000-mapping.dmp
-
memory/4504-222-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/4504-224-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/4760-211-0x0000000000000000-mapping.dmp
-
memory/4760-219-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/4760-215-0x00007FFC2DCE0000-0x00007FFC2E7A1000-memory.dmpFilesize
10.8MB
-
memory/4764-253-0x0000000000000000-mapping.dmp
-
memory/4972-179-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4972-166-0x0000000000000000-mapping.dmp
-
memory/4972-200-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4984-230-0x0000000000000000-mapping.dmp
-
memory/4988-197-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/4988-167-0x0000000000000000-mapping.dmp
-
memory/4988-180-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmpFilesize
10.8MB
-
memory/5000-265-0x0000000000000000-mapping.dmp
-
memory/5088-251-0x0000000000000000-mapping.dmp