dcrat | 8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe
Size

1.3MB
MD5

bef67c01730cfade4ce85dd425dbd6e1
SHA1

7f7aa9e6c1231251e1dab99aa7e39918069bde22
SHA256

8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470
SHA512

533ac8a42689338638d6218245b43399bf17b7b51f99d4fdbbcb0803e6d6eb596a4d9f7b45e2847bab8e037d0b09cf9c93b0fec650e11a519578b2bcab04acb4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4728	schtasks.exe	8
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	4728	schtasks.exe	8

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000022dfa-137.dat	dcrat
behavioral1/files/0x0002000000022dfa-138.dat	dcrat
behavioral1/memory/2432-139-0x0000000000B40000-0x0000000000C50000-memory.dmp	dcrat
behavioral1/files/0x0001000000022e38-169.dat	dcrat
behavioral1/files/0x0001000000022e38-170.dat	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 2 IoCs

pid	Process
2432	DllCommonsvc.exe
4200	SearchApp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office16\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Policies\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Policies\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office16\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\ModifiableWindowsApps\dllhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4264	schtasks.exe
1328	schtasks.exe
4460	schtasks.exe
4232	schtasks.exe
4424	schtasks.exe
4964	schtasks.exe
832	schtasks.exe
2120	schtasks.exe
4876	schtasks.exe
3540	schtasks.exe
1276	schtasks.exe
1416	schtasks.exe
332	schtasks.exe
4504	schtasks.exe
4380	schtasks.exe
796	schtasks.exe
1432	schtasks.exe
1832	schtasks.exe
220	schtasks.exe
4564	schtasks.exe
4656	schtasks.exe
3580	schtasks.exe
4388	schtasks.exe
1064	schtasks.exe
4976	schtasks.exe
4376	schtasks.exe
4360	schtasks.exe
3620	schtasks.exe
2848	schtasks.exe
4048	schtasks.exe
2328	schtasks.exe
3516	schtasks.exe
4452	schtasks.exe
2812	schtasks.exe
3904	schtasks.exe
4248	schtasks.exe
2208	schtasks.exe
112	schtasks.exe
4520	schtasks.exe
3124	schtasks.exe
2488	schtasks.exe
2024	schtasks.exe
4624	schtasks.exe
808	schtasks.exe
3068	schtasks.exe
952	schtasks.exe
3188	schtasks.exe
2324	schtasks.exe
984	schtasks.exe
2560	schtasks.exe
2248	schtasks.exe
1148	schtasks.exe
2780	schtasks.exe
4152	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
2432	DllCommonsvc.exe
900	powershell.exe
3744	powershell.exe
3744	powershell.exe
3840	powershell.exe
3840	powershell.exe
924	powershell.exe
924	powershell.exe
3772	powershell.exe
3772	powershell.exe
1008	powershell.exe
1008	powershell.exe
756	powershell.exe
756	powershell.exe
5108	powershell.exe
5108	powershell.exe
2468	powershell.exe
2468	powershell.exe
3908	powershell.exe
3908	powershell.exe
2104	powershell.exe
2104	powershell.exe
1948	powershell.exe
1948	powershell.exe
3284	powershell.exe
3284	powershell.exe
4780	powershell.exe
4844	powershell.exe
4780	powershell.exe
4844	powershell.exe
1832	powershell.exe
1832	powershell.exe
1900	powershell.exe
1900	powershell.exe
3508	powershell.exe
3508	powershell.exe
4036	powershell.exe
4036	powershell.exe
900	powershell.exe
900	powershell.exe
4200	SearchApp.exe
4200	SearchApp.exe
3840	powershell.exe
3840	powershell.exe
924	powershell.exe
924	powershell.exe
3744	powershell.exe
3744	powershell.exe
756	powershell.exe
756	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4200	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	DllCommonsvc.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4200	SearchApp.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4312	2012	8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe	81
PID 2012 wrote to memory of 4312	2012	8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe	81
PID 2012 wrote to memory of 4312	2012	8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe	81
PID 4312 wrote to memory of 4796	4312	WScript.exe	82
PID 4312 wrote to memory of 4796	4312	WScript.exe	82
PID 4312 wrote to memory of 4796	4312	WScript.exe	82
PID 4796 wrote to memory of 2432	4796	cmd.exe	84
PID 4796 wrote to memory of 2432	4796	cmd.exe	84
PID 2432 wrote to memory of 900	2432	DllCommonsvc.exe	140
PID 2432 wrote to memory of 900	2432	DllCommonsvc.exe	140
PID 2432 wrote to memory of 756	2432	DllCommonsvc.exe	141
PID 2432 wrote to memory of 756	2432	DllCommonsvc.exe	141
PID 2432 wrote to memory of 3744	2432	DllCommonsvc.exe	142
PID 2432 wrote to memory of 3744	2432	DllCommonsvc.exe	142
PID 2432 wrote to memory of 3840	2432	DllCommonsvc.exe	143
PID 2432 wrote to memory of 3840	2432	DllCommonsvc.exe	143
PID 2432 wrote to memory of 924	2432	DllCommonsvc.exe	144
PID 2432 wrote to memory of 924	2432	DllCommonsvc.exe	144
PID 2432 wrote to memory of 3772	2432	DllCommonsvc.exe	154
PID 2432 wrote to memory of 3772	2432	DllCommonsvc.exe	154
PID 2432 wrote to memory of 1008	2432	DllCommonsvc.exe	147
PID 2432 wrote to memory of 1008	2432	DllCommonsvc.exe	147
PID 2432 wrote to memory of 5108	2432	DllCommonsvc.exe	149
PID 2432 wrote to memory of 5108	2432	DllCommonsvc.exe	149
PID 2432 wrote to memory of 2468	2432	DllCommonsvc.exe	153
PID 2432 wrote to memory of 2468	2432	DllCommonsvc.exe	153
PID 2432 wrote to memory of 3908	2432	DllCommonsvc.exe	151
PID 2432 wrote to memory of 3908	2432	DllCommonsvc.exe	151
PID 2432 wrote to memory of 2104	2432	DllCommonsvc.exe	158
PID 2432 wrote to memory of 2104	2432	DllCommonsvc.exe	158
PID 2432 wrote to memory of 1948	2432	DllCommonsvc.exe	160
PID 2432 wrote to memory of 1948	2432	DllCommonsvc.exe	160
PID 2432 wrote to memory of 3284	2432	DllCommonsvc.exe	162
PID 2432 wrote to memory of 3284	2432	DllCommonsvc.exe	162
PID 2432 wrote to memory of 4780	2432	DllCommonsvc.exe	164
PID 2432 wrote to memory of 4780	2432	DllCommonsvc.exe	164
PID 2432 wrote to memory of 4844	2432	DllCommonsvc.exe	165
PID 2432 wrote to memory of 4844	2432	DllCommonsvc.exe	165
PID 2432 wrote to memory of 1832	2432	DllCommonsvc.exe	177
PID 2432 wrote to memory of 1832	2432	DllCommonsvc.exe	177
PID 2432 wrote to memory of 1900	2432	DllCommonsvc.exe	169
PID 2432 wrote to memory of 1900	2432	DllCommonsvc.exe	169
PID 2432 wrote to memory of 4036	2432	DllCommonsvc.exe	170
PID 2432 wrote to memory of 4036	2432	DllCommonsvc.exe	170
PID 2432 wrote to memory of 3508	2432	DllCommonsvc.exe	171
PID 2432 wrote to memory of 3508	2432	DllCommonsvc.exe	171
PID 2432 wrote to memory of 4200	2432	DllCommonsvc.exe	178
PID 2432 wrote to memory of 4200	2432	DllCommonsvc.exe	178

C:\Users\Admin\AppData\Local\Temp\8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe
"C:\Users\Admin\AppData\Local\Temp\8396a4169d1ea26e511a2d4ec15414d2afef01575b9975399e64c91a74e19470.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Policies\Registry.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office16\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Office16\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Public\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Policies\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Policies\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/756-154-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/756-194-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/900-190-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/900-151-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/900-158-0x000002A0F8C20000-0x000002A0F8C42000-memory.dmp

Filesize
136KB

Download
memory/924-164-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/924-189-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1008-166-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1008-202-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1832-212-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1832-175-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1900-184-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1900-220-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1948-171-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/1948-207-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/2104-209-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/2104-182-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/2432-172-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/2432-140-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/2432-139-0x0000000000B40000-0x0000000000C50000-memory.dmp

Filesize
1.1MB

Download
memory/2468-201-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/2468-181-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3284-211-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3284-173-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3508-177-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3508-222-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3744-157-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3744-191-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3772-179-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3772-198-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3840-160-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3840-195-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3908-206-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/3908-167-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4036-178-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4036-221-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4200-223-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4200-176-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4780-217-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4780-183-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4844-174-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/4844-215-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/5108-180-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download
memory/5108-200-0x00007FFA06FA0000-0x00007FFA07A61000-memory.dmp

Filesize
10.8MB

Download