dcrat | 7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2023 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe
Size

1.3MB
MD5

7ed96a76ca67210719cb05b24b3f7de6
SHA1

83af65839c930622e4d20b3d7a98d8ee1a0ef8c5
SHA256

7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042
SHA512

2137fb59411b9f1c0fda4a5a6154012e35eeb37e52d645117cc725b2c0d5e221006a601c92d628be2f1e93d1b4573f3a57b1ccb0703df6bc28a86c7e821adaf3
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	2056	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	2056	schtasks.exe

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/1128-139-0x00000000008E0000-0x00000000009F0000-memory.dmp	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	dcrat

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWScript.exeDllCommonsvc.exeWmiPrvSE.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe

Executes dropped EXE 12 IoCs

Processes:

DllCommonsvc.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

pid	process
1128	DllCommonsvc.exe
2940	WmiPrvSE.exe
3108	WmiPrvSE.exe
528	WmiPrvSE.exe
1064	WmiPrvSE.exe
4356	WmiPrvSE.exe
3644	WmiPrvSE.exe
4636	WmiPrvSE.exe
4220	WmiPrvSE.exe
1296	WmiPrvSE.exe
4276	WmiPrvSE.exe
5004	WmiPrvSE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\WmiPrvSE.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\Provisioning\Autopilot\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\security\EDP\csrss.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\security\EDP\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\security\EDP\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4236	schtasks.exe
3164	schtasks.exe
704	schtasks.exe
1556	schtasks.exe
1632	schtasks.exe
3592	schtasks.exe
1012	schtasks.exe
4808	schtasks.exe
3124	schtasks.exe
2440	schtasks.exe
2088	schtasks.exe
4940	schtasks.exe
2924	schtasks.exe
2844	schtasks.exe
2372	schtasks.exe
4908	schtasks.exe
2860	schtasks.exe
672	schtasks.exe
1604	schtasks.exe
5016	schtasks.exe
2948	schtasks.exe
2416	schtasks.exe
1308	schtasks.exe
4476	schtasks.exe
5112	schtasks.exe
1704	schtasks.exe
3724	schtasks.exe
556	schtasks.exe
4080	schtasks.exe
60	schtasks.exe
1508	schtasks.exe
656	schtasks.exe
1488	schtasks.exe
4888	schtasks.exe
3760	schtasks.exe
4664	schtasks.exe

Modifies registry class 12 IoCs

Processes:

WmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeDllCommonsvc.exeWmiPrvSE.exeWmiPrvSE.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	WmiPrvSE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exesihclient.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execmd.exepowershell.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exe

pid	process
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1128	DllCommonsvc.exe
1384	powershell.exe
1384	powershell.exe
3988	powershell.exe
3988	powershell.exe
1948	sihclient.exe
1948	sihclient.exe
3368	powershell.exe
3368	powershell.exe
4584	powershell.exe
4584	powershell.exe
1340	powershell.exe
1340	powershell.exe
1228	powershell.exe
1228	powershell.exe
4332	powershell.exe
4332	powershell.exe
4948	powershell.exe
4948	powershell.exe
4116	powershell.exe
4116	powershell.exe
4584	powershell.exe
3712	powershell.exe
3712	powershell.exe
5044	cmd.exe
5044	cmd.exe
4404	powershell.exe
4404	powershell.exe
5044	cmd.exe
1384	powershell.exe
1384	powershell.exe
1948	sihclient.exe
1948	sihclient.exe
3988	powershell.exe
3988	powershell.exe
3368	powershell.exe
3368	powershell.exe
1340	powershell.exe
1228	powershell.exe
4332	powershell.exe
3712	powershell.exe
4948	powershell.exe
4116	powershell.exe
4404	powershell.exe
2940	WmiPrvSE.exe
3108	WmiPrvSE.exe
528	WmiPrvSE.exe
1064	WmiPrvSE.exe
4356	WmiPrvSE.exe
3644	WmiPrvSE.exe
4636	WmiPrvSE.exe
4220	WmiPrvSE.exe
1296	WmiPrvSE.exe
4276	WmiPrvSE.exe
5004	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	1128	DllCommonsvc.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	1948	sihclient.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	5044	cmd.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	2940	WmiPrvSE.exe
Token: SeDebugPrivilege	3108	WmiPrvSE.exe
Token: SeDebugPrivilege	528	WmiPrvSE.exe
Token: SeDebugPrivilege	1064	WmiPrvSE.exe
Token: SeDebugPrivilege	4356	WmiPrvSE.exe
Token: SeDebugPrivilege	3644	WmiPrvSE.exe
Token: SeDebugPrivilege	4636	WmiPrvSE.exe
Token: SeDebugPrivilege	4220	WmiPrvSE.exe
Token: SeDebugPrivilege	1296	WmiPrvSE.exe
Token: SeDebugPrivilege	4276	WmiPrvSE.exe
Token: SeDebugPrivilege	5004	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exeWScript.execmd.exeDllCommonsvc.execmd.exeWmiPrvSE.execmd.exeWmiPrvSE.execmd.exeWmiPrvSE.execmd.exeWmiPrvSE.execmd.exe

description	pid	process	target process
PID 4828 wrote to memory of 1192	4828	7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe	WScript.exe
PID 4828 wrote to memory of 1192	4828	7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe	WScript.exe
PID 4828 wrote to memory of 1192	4828	7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe	WScript.exe
PID 1192 wrote to memory of 4872	1192	WScript.exe	cmd.exe
PID 1192 wrote to memory of 4872	1192	WScript.exe	cmd.exe
PID 1192 wrote to memory of 4872	1192	WScript.exe	cmd.exe
PID 4872 wrote to memory of 1128	4872	cmd.exe	DllCommonsvc.exe
PID 4872 wrote to memory of 1128	4872	cmd.exe	DllCommonsvc.exe
PID 1128 wrote to memory of 3988	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 3988	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1384	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1384	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1948	1128	DllCommonsvc.exe	sihclient.exe
PID 1128 wrote to memory of 1948	1128	DllCommonsvc.exe	sihclient.exe
PID 1128 wrote to memory of 3368	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 3368	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4584	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4584	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1340	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1340	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4332	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4332	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1228	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 1228	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4948	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4948	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 5044	1128	DllCommonsvc.exe	cmd.exe
PID 1128 wrote to memory of 5044	1128	DllCommonsvc.exe	cmd.exe
PID 1128 wrote to memory of 4116	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4116	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4404	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4404	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 3712	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 3712	1128	DllCommonsvc.exe	powershell.exe
PID 1128 wrote to memory of 4840	1128	DllCommonsvc.exe	cmd.exe
PID 1128 wrote to memory of 4840	1128	DllCommonsvc.exe	cmd.exe
PID 4840 wrote to memory of 1696	4840	cmd.exe	w32tm.exe
PID 4840 wrote to memory of 1696	4840	cmd.exe	w32tm.exe
PID 4840 wrote to memory of 2940	4840	cmd.exe	WmiPrvSE.exe
PID 4840 wrote to memory of 2940	4840	cmd.exe	WmiPrvSE.exe
PID 2940 wrote to memory of 5044	2940	WmiPrvSE.exe	cmd.exe
PID 2940 wrote to memory of 5044	2940	WmiPrvSE.exe	cmd.exe
PID 5044 wrote to memory of 4020	5044	cmd.exe	w32tm.exe
PID 5044 wrote to memory of 4020	5044	cmd.exe	w32tm.exe
PID 5044 wrote to memory of 3108	5044	cmd.exe	WmiPrvSE.exe
PID 5044 wrote to memory of 3108	5044	cmd.exe	WmiPrvSE.exe
PID 3108 wrote to memory of 2844	3108	WmiPrvSE.exe	cmd.exe
PID 3108 wrote to memory of 2844	3108	WmiPrvSE.exe	cmd.exe
PID 2844 wrote to memory of 4340	2844	cmd.exe	w32tm.exe
PID 2844 wrote to memory of 4340	2844	cmd.exe	w32tm.exe
PID 2844 wrote to memory of 528	2844	cmd.exe	WmiPrvSE.exe
PID 2844 wrote to memory of 528	2844	cmd.exe	WmiPrvSE.exe
PID 528 wrote to memory of 2300	528	WmiPrvSE.exe	cmd.exe
PID 528 wrote to memory of 2300	528	WmiPrvSE.exe	cmd.exe
PID 2300 wrote to memory of 3780	2300	cmd.exe	w32tm.exe
PID 2300 wrote to memory of 3780	2300	cmd.exe	w32tm.exe
PID 2300 wrote to memory of 1064	2300	cmd.exe	WmiPrvSE.exe
PID 2300 wrote to memory of 1064	2300	cmd.exe	WmiPrvSE.exe
PID 1064 wrote to memory of 4120	1064	WmiPrvSE.exe	cmd.exe
PID 1064 wrote to memory of 4120	1064	WmiPrvSE.exe	cmd.exe
PID 4120 wrote to memory of 3652	4120	cmd.exe	w32tm.exe
PID 4120 wrote to memory of 3652	4120	cmd.exe	w32tm.exe
PID 4120 wrote to memory of 4356	4120	cmd.exe	WmiPrvSE.exe
PID 4120 wrote to memory of 4356	4120	cmd.exe	WmiPrvSE.exe

C:\Users\Admin\AppData\Local\Temp\7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe
"C:\Users\Admin\AppData\Local\Temp\7382e53ab73191874d857e20d91b597148eec69e5825196e4e7b296db02d6042.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\EDP\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WaaSMedicAgent.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\OfficeClickToRun.exe'
        5⤵
        
        PID:5044
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mg59nw4HWA.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1696
      - C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4020
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KOC6cu7vKW.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pnRbx2xD7z.bat"
        15⤵
        
        PID:4040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4544
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat"
        17⤵
        
        PID:4032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4884
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat"
        19⤵
        
        PID:4508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2368
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        21⤵
        
        PID:3848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2760
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat"
        23⤵
        
        PID:1240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3692
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"
        25⤵
        
        PID:1608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4364
        
        C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe
        
        "C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\security\EDP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\security\EDP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\security\EDP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\ssh\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844
- C:\Windows\system32\w32tm.exe
  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
  2⤵
  PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3592

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv g/3ARcqI9EOm3x2nzMaQpw.0.2
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3780

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat

Filesize
211B

MD5
fe9f523a8247891b58638b8dbbf68fcc

SHA1
ba1c104f5c72078a4faceaaffa3984de3274a5fb

SHA256
7526da6fa8106cb3c9d276fc542892d8313be0af1f67dc2ddc718346e3887f43

SHA512
5cf838811d26627611316dfa2d1706d6c4c4f930f8469e3c8f37cc5652ea6b02d6a6af36355e6c19d9e8cb1b7d35b958d94d8fdc631b9a3ba73a142cc2309729

Download Submit
C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat

Filesize
211B

MD5
a013af47f54f9fd076df0160b366e828

SHA1
3e7651db3390b645b5655363d4caaef18a274edb

SHA256
23270297e6438922a3056b6de3f49b5e83cecafd7bf4e56dd60f0ea03709efed

SHA512
6506bbfff5e8e0d3a7339d6777d8e5ab994cc1f72df2b2ffd243139e55e51b315bf9a45258fab32db78caa015bf8a26adb7e684a8be4006ecaa42afd8875ffc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KOC6cu7vKW.bat

Filesize
211B

MD5
867d263a957e4e077003bddb1ac43de5

SHA1
b6df1bfcafff230adaaa907a993249b0ef1e82c8

SHA256
02362b9c468005708785464bad642d058833fae16702a0a1b158c14bb3decfa6

SHA512
12cf8bb2f48c45c81e180b5e7ec761499caac7d4762db8c80f542366adaf267f674a7db2f16e5e33de6ec26e409af99fc122f22b7a97d2cc18a41f04e63eb818

Download Submit
C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat

Filesize
211B

MD5
7304dc6e49ebc6f5e83d87b3795b9433

SHA1
4e88366a9a7ee4f64479141e63ec0942ef8a1e84

SHA256
c48689ddc9c55e541e0a9248c5e764b64ddc446bf63e9b6a713f1c2f9fcc2b38

SHA512
191db60566f74aa9a8afcee447b4b0cdc60cdfc7c38136456f487447c8d6a97db6067d31a54ae6102ef8395a27db5349a5ab49b950424ebccf6c5172544cb2eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat

Filesize
211B

MD5
f63485d9e8c67588a3dae048a954497c

SHA1
de735b27d4f38f3da7a7f01d5aafb7924a1f76bc

SHA256
0051b3d36348c6bdb334fdb4083b0855dc37a8ab4b978562c904f06134a45f34

SHA512
a6f6f1ad9f2e839bd4c82979d8e469496408eba1cdf9edb57e399668f4398c612003ad1d00f6dfefa3ffec5856268ae84b3df4f9cba8b9b66e6a887d7e9b3a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat

Filesize
211B

MD5
376be26d688df60f09e00202bf14b078

SHA1
13bfa11af180888df783e1768bbf371f1f3d414a

SHA256
e35e03d8bb2096aab0f097f5268c5b59d2ed60593beb06ba647e1b21c06b3752

SHA512
f5166ca695540be1e7c2c6b80600f9387f751c5a5d358c584fb0d629d103cced4ff9b1cbeebe61d5ed3e5c287e2c3bd2e050f0ff52ecb4894ffb2d9abf790735

Download Submit
C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat

Filesize
211B

MD5
efa4bebfa8dcd1782ac9b05839970d3e

SHA1
f9ba4d1626a33a0865b567067b602bf9304674a9

SHA256
a3d68e421fa2781ee837d127ec107661c577fcea5df8a0ad24d068b854f91e5b

SHA512
1114c4cfd49ed93fcde3ecb4f178bcc9e6283d002fd3998f10fcf00102dc2ef608b2651c55fed7cbaa0313c12d7c52de739f6dd2a0b5f897de9dd09e40f3e777

Download Submit
C:\Users\Admin\AppData\Local\Temp\mg59nw4HWA.bat

Filesize
211B

MD5
a1f21102608a776d26aeb0a8dfe8343e

SHA1
e9850c14ffb26a2ea4cd8766bc90b3f531fbb408

SHA256
9855077fce1272f317fe611e170f3665f6966db2b50fef0f3ff79c14e9145c9c

SHA512
056e3167fa77ec1ce3030de7ebaca6aa8d3924956a6bf1461485280da039ea3020e5477fd59d1aaf5d48f9012ad9fed274e63fa49663d45ceb4678d25158975e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnRbx2xD7z.bat

Filesize
211B

MD5
48ff1c4d5ad05937393216190232bf9c

SHA1
6e155b480a12dd4ed6031c41a5345fa91f94882b

SHA256
c340c3ce02986d0a6850f9070c68df90ae20fc1eee50ff72de7bfa5dbce07031

SHA512
ccc835f58d16fc4d14a416a575bb032f51341c5666dd07a2438b39f02e031169b87cffafb4cd56f62bc2ab0bf79299b7f4eb325d1120f5f6a194f71ae466c4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat

Filesize
211B

MD5
1ee5f215271b95e19d8878032b277c44

SHA1
fe7882bb80e5541e6450a9d39386ed657ae84150

SHA256
e75bbf4329c48b424d84bbc4b7fdef58241a9a8431389c443bcada1af3136e20

SHA512
4b581bf0105325d821c96f1b24806225079d29de518cf6b3cec707a98b4775dc0826b7d2fb3f723973c2b30bc0a7a058690117387f95c3b314f93043a5927c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
211B

MD5
a05a5c6cd80a3b38cf557bafef111b61

SHA1
ad9b2c47619af144d4ff8c46fbdc24cfc572b1b9

SHA256
79db286959f3c733b991c1fed37220954507b93f1d05bae23b0725b4f9a9b9fb

SHA512
a763d91a7459536b65bcf548c89153febd6bf97f600aa42cc662707dd8ba032874ad78c987a68916bac627b28537a113ba3580b8ca8bddcb39a76f32347559ff

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Provisioning\Autopilot\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/528-220-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/528-216-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/528-214-0x0000000000000000-mapping.dmp

Download
memory/1064-221-0x0000000000000000-mapping.dmp

Download
memory/1064-223-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/1064-227-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/1128-157-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1128-136-0x0000000000000000-mapping.dmp

Download
memory/1128-139-0x00000000008E0000-0x00000000009F0000-memory.dmp

Filesize
1.1MB

Download
memory/1128-140-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1192-132-0x0000000000000000-mapping.dmp

Download
memory/1228-166-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1228-190-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1228-148-0x0000000000000000-mapping.dmp

Download
memory/1240-259-0x0000000000000000-mapping.dmp

Download
memory/1296-256-0x0000000000000000-mapping.dmp

Download
memory/1296-262-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/1296-258-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/1340-163-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1340-186-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1340-146-0x0000000000000000-mapping.dmp

Download
memory/1384-142-0x0000000000000000-mapping.dmp

Download
memory/1384-183-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1384-158-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1384-154-0x000001FB3F8F0000-0x000001FB3F912000-memory.dmp

Filesize
136KB

Download
memory/1608-266-0x0000000000000000-mapping.dmp

Download
memory/1696-169-0x0000000000000000-mapping.dmp

Download
memory/1948-143-0x0000000000000000-mapping.dmp

Download
memory/1948-159-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/1948-179-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/2300-217-0x0000000000000000-mapping.dmp

Download
memory/2368-247-0x0000000000000000-mapping.dmp

Download
memory/2760-254-0x0000000000000000-mapping.dmp

Download
memory/2844-210-0x0000000000000000-mapping.dmp

Download
memory/2940-201-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/2940-205-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/2940-198-0x0000000000000000-mapping.dmp

Download
memory/3108-206-0x0000000000000000-mapping.dmp

Download
memory/3108-209-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3108-213-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3368-184-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3368-144-0x0000000000000000-mapping.dmp

Download
memory/3368-160-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3644-237-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/3644-241-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/3644-235-0x0000000000000000-mapping.dmp

Download
memory/3652-226-0x0000000000000000-mapping.dmp

Download
memory/3692-261-0x0000000000000000-mapping.dmp

Download
memory/3712-188-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3712-171-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3712-153-0x0000000000000000-mapping.dmp

Download
memory/3780-219-0x0000000000000000-mapping.dmp

Download
memory/3848-252-0x0000000000000000-mapping.dmp

Download
memory/3988-181-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/3988-141-0x0000000000000000-mapping.dmp

Download
memory/3988-156-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4020-204-0x0000000000000000-mapping.dmp

Download
memory/4032-238-0x0000000000000000-mapping.dmp

Download
memory/4040-231-0x0000000000000000-mapping.dmp

Download
memory/4116-167-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4116-195-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4116-151-0x0000000000000000-mapping.dmp

Download
memory/4120-224-0x0000000000000000-mapping.dmp

Download
memory/4220-255-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4220-251-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4220-249-0x0000000000000000-mapping.dmp

Download
memory/4276-263-0x0000000000000000-mapping.dmp

Download
memory/4276-265-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4276-269-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4332-164-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4332-147-0x0000000000000000-mapping.dmp

Download
memory/4332-191-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4340-212-0x0000000000000000-mapping.dmp

Download
memory/4356-233-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4356-230-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4356-228-0x0000000000000000-mapping.dmp

Download
memory/4364-268-0x0000000000000000-mapping.dmp

Download
memory/4404-152-0x0000000000000000-mapping.dmp

Download
memory/4404-197-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4404-170-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4508-245-0x0000000000000000-mapping.dmp

Download
memory/4544-234-0x0000000000000000-mapping.dmp

Download
memory/4584-174-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4584-161-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4584-145-0x0000000000000000-mapping.dmp

Download
memory/4636-244-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4636-248-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/4636-242-0x0000000000000000-mapping.dmp

Download
memory/4840-155-0x0000000000000000-mapping.dmp

Download
memory/4872-135-0x0000000000000000-mapping.dmp

Download
memory/4884-240-0x0000000000000000-mapping.dmp

Download
memory/4948-149-0x0000000000000000-mapping.dmp

Download
memory/4948-194-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/4948-165-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/5004-270-0x0000000000000000-mapping.dmp

Download
memory/5004-272-0x00007FFCA8970000-0x00007FFCA9431000-memory.dmp

Filesize
10.8MB

Download
memory/5044-150-0x0000000000000000-mapping.dmp

Download
memory/5044-168-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/5044-176-0x00007FFCAA850000-0x00007FFCAB311000-memory.dmp

Filesize
10.8MB

Download
memory/5044-202-0x0000000000000000-mapping.dmp

Download