dcrat | 3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe
Size

1.3MB
MD5

bd6a25de7d325676506aba635b0f5068
SHA1

ef6afe7b5245fd0e8e8bc5bb7849de454a7779ef
SHA256

3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d
SHA512

1644e6f52592742270b39a56891a0ec62eb597e2577d93377a4428b378d01aade1e16ca7bfc18c7d5299675dd3ce0142cf47d2f89ac19c92a0fe9a36f6b5d84f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	4280	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	4280	schtasks.exe

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/992-139-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat
C:\Recovery\WindowsRE\services.exe	dcrat

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

services.exeservices.exeservices.exeservices.exeservices.exe3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exeWScript.exeservices.exeservices.exeDllCommonsvc.exeservices.exeservices.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	services.exe

Executes dropped EXE 10 IoCs

Processes:

DllCommonsvc.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe

pid	process
992	DllCommonsvc.exe
3448	services.exe
6012	services.exe
3748	services.exe
4396	services.exe
3544	services.exe
1976	services.exe
3824	services.exe
1076	services.exe
5248	services.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in System32 directory 1 IoCs

Processes:

DllCommonsvc.exe

description ioc process

File created C:\Windows\SysWOW64\DriverStore\winlogon.exe DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\DriverStore\winlogon.exe	DllCommonsvc.exe

Drops file in Program Files directory 4 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\DigitalLocker\en-US\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\6ccacd8608530f	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4928	schtasks.exe
900	schtasks.exe
3480	schtasks.exe
4916	schtasks.exe
1452	schtasks.exe
1616	schtasks.exe
3532	schtasks.exe
2348	schtasks.exe
4988	schtasks.exe
4252	schtasks.exe
2676	schtasks.exe
3728	schtasks.exe
404	schtasks.exe
3492	schtasks.exe
3588	schtasks.exe
1204	schtasks.exe
3864	schtasks.exe
3924	schtasks.exe
1968	schtasks.exe
2200	schtasks.exe
3880	schtasks.exe
3824	schtasks.exe
1604	schtasks.exe
2280	schtasks.exe
4500	schtasks.exe
3508	schtasks.exe
3232	schtasks.exe
2680	schtasks.exe
3536	schtasks.exe
3912	schtasks.exe
2792	schtasks.exe
4004	schtasks.exe
1828	schtasks.exe
2292	schtasks.exe
4092	schtasks.exe
3084	schtasks.exe
3672	schtasks.exe
4100	schtasks.exe
1784	schtasks.exe
1632	schtasks.exe
3036	schtasks.exe
1372	schtasks.exe
1004	schtasks.exe
1576	schtasks.exe
100	schtasks.exe
2324	schtasks.exe
3896	schtasks.exe
2368	schtasks.exe
3048	schtasks.exe
4908	schtasks.exe
712	schtasks.exe

Modifies registry class 10 IoCs

Processes:

services.exeservices.exeservices.exeservices.exeservices.exeservices.exeservices.exe3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exeservices.exeservices.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	services.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeservices.exe

pid	process
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
2660	powershell.exe
2660	powershell.exe
4948	powershell.exe
4948	powershell.exe
4224	powershell.exe
4224	powershell.exe
4204	powershell.exe
4204	powershell.exe
1348	powershell.exe
1348	powershell.exe
1120	powershell.exe
1120	powershell.exe
1116	powershell.exe
1116	powershell.exe
836	powershell.exe
836	powershell.exe
4820	powershell.exe
4820	powershell.exe
3944	powershell.exe
3944	powershell.exe
952	powershell.exe
952	powershell.exe
1360	powershell.exe
1360	powershell.exe
4024	powershell.exe
4024	powershell.exe
3572	powershell.exe
3572	powershell.exe
3444	powershell.exe
3444	powershell.exe
5024	powershell.exe
4848	powershell.exe
4848	powershell.exe
5024	powershell.exe
1188	powershell.exe
1188	powershell.exe
3448	services.exe
3448	services.exe
2660	powershell.exe
2660	powershell.exe
4224	powershell.exe
4224	powershell.exe
4948	powershell.exe
4948	powershell.exe
1348	powershell.exe
1348	powershell.exe
4204	powershell.exe
4204	powershell.exe
1116	powershell.exe
1120	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	992	DllCommonsvc.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	3448	services.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	6012	services.exe
Token: SeDebugPrivilege	3748	services.exe
Token: SeDebugPrivilege	4396	services.exe
Token: SeDebugPrivilege	3544	services.exe
Token: SeDebugPrivilege	1976	services.exe
Token: SeDebugPrivilege	3824	services.exe
Token: SeDebugPrivilege	1076	services.exe
Token: SeDebugPrivilege	5248	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exeWScript.execmd.exeDllCommonsvc.exeservices.execmd.exeservices.execmd.exeservices.execmd.exe

description	pid	process	target process
PID 4732 wrote to memory of 1460	4732	3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe	WScript.exe
PID 4732 wrote to memory of 1460	4732	3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe	WScript.exe
PID 4732 wrote to memory of 1460	4732	3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe	WScript.exe
PID 1460 wrote to memory of 1516	1460	WScript.exe	cmd.exe
PID 1460 wrote to memory of 1516	1460	WScript.exe	cmd.exe
PID 1460 wrote to memory of 1516	1460	WScript.exe	cmd.exe
PID 1516 wrote to memory of 992	1516	cmd.exe	DllCommonsvc.exe
PID 1516 wrote to memory of 992	1516	cmd.exe	DllCommonsvc.exe
PID 992 wrote to memory of 2660	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 2660	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4948	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4948	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4224	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4224	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4204	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4204	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1348	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1348	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1116	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1116	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1120	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1120	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4820	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4820	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 836	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 836	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 952	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 952	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3944	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3944	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4024	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4024	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1360	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1360	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 5024	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 5024	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3444	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3444	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3572	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3572	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4848	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 4848	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1188	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 1188	992	DllCommonsvc.exe	powershell.exe
PID 992 wrote to memory of 3448	992	DllCommonsvc.exe	services.exe
PID 992 wrote to memory of 3448	992	DllCommonsvc.exe	services.exe
PID 3448 wrote to memory of 5636	3448	services.exe	cmd.exe
PID 3448 wrote to memory of 5636	3448	services.exe	cmd.exe
PID 5636 wrote to memory of 5748	5636	cmd.exe	w32tm.exe
PID 5636 wrote to memory of 5748	5636	cmd.exe	w32tm.exe
PID 5636 wrote to memory of 6012	5636	cmd.exe	services.exe
PID 5636 wrote to memory of 6012	5636	cmd.exe	services.exe
PID 6012 wrote to memory of 4680	6012	services.exe	cmd.exe
PID 6012 wrote to memory of 4680	6012	services.exe	cmd.exe
PID 4680 wrote to memory of 3652	4680	cmd.exe	w32tm.exe
PID 4680 wrote to memory of 3652	4680	cmd.exe	w32tm.exe
PID 4680 wrote to memory of 3748	4680	cmd.exe	services.exe
PID 4680 wrote to memory of 3748	4680	cmd.exe	services.exe
PID 3748 wrote to memory of 1084	3748	services.exe	cmd.exe
PID 3748 wrote to memory of 1084	3748	services.exe	cmd.exe
PID 1084 wrote to memory of 5476	1084	cmd.exe	w32tm.exe
PID 1084 wrote to memory of 5476	1084	cmd.exe	w32tm.exe
PID 1084 wrote to memory of 4396	1084	cmd.exe	services.exe
PID 1084 wrote to memory of 4396	1084	cmd.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe
"C:\Users\Admin\AppData\Local\Temp\3fa849944b3a8a21b20331abdfcf776cf875ba4329ee13e61bb5806c5368fa3d.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\SearchApp.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\upfc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\Idle.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\cmd.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:5636

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:5748

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V61H6ynXXY.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:3652

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"
10⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
11⤵
PID:5476

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"
12⤵
PID:3560

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
13⤵
PID:4472

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"
14⤵
PID:2976

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
15⤵
PID:992

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat"
16⤵
PID:4684

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
17⤵
PID:5348

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W0gPze1DKI.bat"
18⤵
PID:1528

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
19⤵
PID:1176

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ixgWq8OOYW.bat"
20⤵
PID:3768

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
21⤵
PID:4324

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"
22⤵
PID:460

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
23⤵
PID:2348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\All Users\Templates\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Public\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c6c940df49fc678d1c74fea3c57a32f9

SHA1
79edd715358a82e6d29970998ff2e9b235ea4217

SHA256
4e50925adb70141467a7081cc905c76fd6dab841195400683f9f67fc2602aa0a

SHA512
3c1df9c18f1756ead841f68916dec03a066078b0705443d3f886fd990e2e42ebbffd46916be3f6fe39ea0505fc2c848fbdea56828fbd5aa5f24b329f8d979707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat

Filesize
199B

MD5
bb1238598f947679ea4e0883d22fca5a

SHA1
bf07182b9bcf3e037b99d22a09179361e7fc7cf4

SHA256
7bc09229168a2b9738890196377a871fd829d48b3939adc1e7e0a2ef1736180a

SHA512
b0839ad681fc11d0239e92a542387b681791fac72952f2629013a245e359bcfa603873d52399b4eb5756a2723dd33f02ac198fddb2b1325274ab4a656c9e2822

Download Submit
C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat

Filesize
199B

MD5
bb1238598f947679ea4e0883d22fca5a

SHA1
bf07182b9bcf3e037b99d22a09179361e7fc7cf4

SHA256
7bc09229168a2b9738890196377a871fd829d48b3939adc1e7e0a2ef1736180a

SHA512
b0839ad681fc11d0239e92a542387b681791fac72952f2629013a245e359bcfa603873d52399b4eb5756a2723dd33f02ac198fddb2b1325274ab4a656c9e2822

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat

Filesize
199B

MD5
581aefea2dcd4cdb6714af509f91b29e

SHA1
c4f05b2f02ed46d2b9205a1d30e3daae5abe942f

SHA256
3664f9227efe74a164804a37476362e2cb04d4a23aef93d860463197150554b4

SHA512
c89c6eb4ea7bc97491b8f14e7abaf1a53b91097aaad45972113a1b544fc0e99350ea4cdb308954620de3890fd88d38876caa8be2f82bb3f9e3baeaff37d3d5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat

Filesize
199B

MD5
a7c93663d9e780c53d1d1c7a4c810cc3

SHA1
ca8b33b0d60ac48d0aa9454a8bf4b791d123da41

SHA256
000958fcd03ed35ac543edefd4ae91de338ee9e13c69935b3770fb4c47e3d91c

SHA512
00a4beb71da8193e70532f2c270d058b415eb386078b90ad762c8940dd41186de8242049cefdca3660d2c294f000a9ea1163077619de5a17540f54e913fbec78

Download Submit
C:\Users\Admin\AppData\Local\Temp\V61H6ynXXY.bat

Filesize
199B

MD5
8779341f563a193dc26c5eb4ea96fe40

SHA1
95e974c0f362e30b9562f80d4e6c6b6e7a7d7ebf

SHA256
4413a8947bc1dcbd2c18478f02f249127605e0c012d7211b67aa60277d6cdb8a

SHA512
52d40797783a02a8d1b22ee9348bd937f84048f218d289e77693392c7a7b262685bb66513a42c4abf269cd414b38690ebc69a7bcd7d365445d7e1340a19f9753

Download Submit
C:\Users\Admin\AppData\Local\Temp\W0gPze1DKI.bat

Filesize
199B

MD5
317a676378ff103c2c4bdef6a9b7c744

SHA1
5e1e45dea92d675da1e4004ec6dae814dafa222a

SHA256
5d9dd69b85ba3a20f19cd927ce56cf12dd680c1f8bd1d53b6425077946e8b76e

SHA512
a1bed2e9ab550e649e06e62ca58f62baf2416e44e42180ebdb194febf8bd797d0724c6958dcab940a55539de5a5d7cf4b5be0b563fde2d3732ff00fdb06c87a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixgWq8OOYW.bat

Filesize
199B

MD5
58ef9055ef254a60401648f5e4861858

SHA1
521b8865c7a5e208c49872115b7a44330eb22867

SHA256
a73d1077dabf92afba8b2b5ed231956a86f4d0fb19af2dfa89f27f5cc2b1d88b

SHA512
878bfb29a9f7bd7fb2ae1ae657248a460602b3af936354370d42209732d91be379c2be36834fa707e9e00d8cf6b814a0c0e5aeb84f61de99b1d346c64568e6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat

Filesize
199B

MD5
901d14daf5af0ec29096cbf5f2926898

SHA1
fdabb719c6377ca9de801cd8be4eb9ff8818014f

SHA256
c8568d1c56d02613b97b729de857693854cae2dd3e5bad16e1ab1cbd5981a6fd

SHA512
47890b5b6937cf18a47524475bb35255d7bb158b2161514b09175537522d3c100b02cd10a3b3977c20777b50e630d8de85d2c69d2dbdb0dc00b4e59624e05d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat

Filesize
199B

MD5
16ff482cad416e34600d0344809dae97

SHA1
6ea64939d8a1d6ff8b12e489de82bc51a6626d08

SHA256
32b5ade66f38f7e777bfd504ee124bcd9581de6053ce5a51ad1fc107a05ecb16

SHA512
9832e08eeb1c185510b2b79a8d84f379e1772906502a6081becdbae68e663deb7976a7a5d0e827fa22ce5dbadd712389f340b84a203e9b532b4c7b8bd470b7a3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/460-276-0x0000000000000000-mapping.dmp

Download
memory/836-149-0x0000000000000000-mapping.dmp

Download
memory/836-170-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/836-202-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/952-207-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/952-172-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/952-150-0x0000000000000000-mapping.dmp

Download
memory/992-139-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/992-140-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/992-136-0x0000000000000000-mapping.dmp

Download
memory/992-167-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/992-250-0x0000000000000000-mapping.dmp

Download
memory/1076-272-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/1076-268-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/1076-266-0x0000000000000000-mapping.dmp

Download
memory/1084-234-0x0000000000000000-mapping.dmp

Download
memory/1116-168-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1116-183-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1116-146-0x0000000000000000-mapping.dmp

Download
memory/1120-196-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1120-147-0x0000000000000000-mapping.dmp

Download
memory/1120-169-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1176-264-0x0000000000000000-mapping.dmp

Download
memory/1188-178-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1188-214-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1188-159-0x0000000000000000-mapping.dmp

Download
memory/1348-145-0x0000000000000000-mapping.dmp

Download
memory/1348-192-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1348-166-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1360-153-0x0000000000000000-mapping.dmp

Download
memory/1360-208-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1360-173-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/1460-132-0x0000000000000000-mapping.dmp

Download
memory/1516-135-0x0000000000000000-mapping.dmp

Download
memory/1528-262-0x0000000000000000-mapping.dmp

Download
memory/1976-258-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/1976-254-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/1976-252-0x0000000000000000-mapping.dmp

Download
memory/2348-278-0x0000000000000000-mapping.dmp

Download
memory/2660-157-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/2660-191-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/2660-141-0x0000000000000000-mapping.dmp

Download
memory/2660-165-0x000001E4F8300000-0x000001E4F8322000-memory.dmp

Filesize
136KB

Download
memory/2976-248-0x0000000000000000-mapping.dmp

Download
memory/3444-182-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3444-155-0x0000000000000000-mapping.dmp

Download
memory/3444-215-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3448-162-0x0000000000000000-mapping.dmp

Download
memory/3448-176-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3448-219-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3544-245-0x0000000000000000-mapping.dmp

Download
memory/3544-247-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/3544-251-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/3560-241-0x0000000000000000-mapping.dmp

Download
memory/3572-220-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-156-0x0000000000000000-mapping.dmp

Download
memory/3572-175-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3652-229-0x0000000000000000-mapping.dmp

Download
memory/3748-237-0x00007FF9C65E0000-0x00007FF9C70A1000-memory.dmp

Filesize
10.8MB

Download
memory/3748-231-0x0000000000000000-mapping.dmp

Download
memory/3748-233-0x00007FF9C65E0000-0x00007FF9C70A1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-269-0x0000000000000000-mapping.dmp

Download
memory/3824-259-0x0000000000000000-mapping.dmp

Download
memory/3824-261-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/3824-265-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/3944-206-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3944-171-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/3944-151-0x0000000000000000-mapping.dmp

Download
memory/4024-205-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4024-152-0x0000000000000000-mapping.dmp

Download
memory/4024-181-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-194-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-179-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-144-0x0000000000000000-mapping.dmp

Download
memory/4224-195-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4224-143-0x0000000000000000-mapping.dmp

Download
memory/4224-161-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-271-0x0000000000000000-mapping.dmp

Download
memory/4396-238-0x0000000000000000-mapping.dmp

Download
memory/4396-240-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/4396-244-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/4472-243-0x0000000000000000-mapping.dmp

Download
memory/4680-227-0x0000000000000000-mapping.dmp

Download
memory/4684-255-0x0000000000000000-mapping.dmp

Download
memory/4820-204-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4820-180-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4820-148-0x0000000000000000-mapping.dmp

Download
memory/4848-212-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4848-158-0x0000000000000000-mapping.dmp

Download
memory/4848-177-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-160-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-193-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-142-0x0000000000000000-mapping.dmp

Download
memory/5024-218-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/5024-154-0x0000000000000000-mapping.dmp

Download
memory/5024-174-0x00007FF9C6930000-0x00007FF9C73F1000-memory.dmp

Filesize
10.8MB

Download
memory/5248-273-0x0000000000000000-mapping.dmp

Download
memory/5248-275-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/5248-279-0x00007FF9C6430000-0x00007FF9C6EF1000-memory.dmp

Filesize
10.8MB

Download
memory/5348-257-0x0000000000000000-mapping.dmp

Download
memory/5476-236-0x0000000000000000-mapping.dmp

Download
memory/5636-213-0x0000000000000000-mapping.dmp

Download
memory/5748-222-0x0000000000000000-mapping.dmp

Download
memory/6012-230-0x00007FF9C65E0000-0x00007FF9C70A1000-memory.dmp

Filesize
10.8MB

Download
memory/6012-226-0x00007FF9C65E0000-0x00007FF9C70A1000-memory.dmp

Filesize
10.8MB

Download
memory/6012-223-0x0000000000000000-mapping.dmp

Download