dcrat | 81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a

Analysis

max time kernel
145s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-02-2023 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe
Size

1.3MB
MD5

dc8f2cdbf9f018bd6cf962aade6a64f3
SHA1

4af727f60fb8ad6fd5170d9d89cdfd3a605014b2
SHA256

81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a
SHA512

80a6361a1effde677096b33bd51225228b115dc5ea7140cb18477ea9447316a80b9cd66c17bdc764fd1d55d3848de53e73a50ef275a1579572028dbdf2f5b913
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	192	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	200	3324	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	3324	schtasks.exe	70

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001abec-282.dat	dcrat
behavioral1/files/0x000800000001abec-283.dat	dcrat
behavioral1/memory/3248-284-0x0000000000AE0000-0x0000000000BF0000-memory.dmp	dcrat
behavioral1/files/0x000600000001abf5-349.dat	dcrat
behavioral1/files/0x000600000001abf5-348.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
3248	DllCommonsvc.exe
2980	dwm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Boot\sihost.exe	DllCommonsvc.exe
File created	C:\Windows\addins\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\addins\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4424	schtasks.exe
2104	schtasks.exe
4528	schtasks.exe
812	schtasks.exe
1860	schtasks.exe
1836	schtasks.exe
720	schtasks.exe
532	schtasks.exe
312	schtasks.exe
3188	schtasks.exe
4848	schtasks.exe
5016	schtasks.exe
1940	schtasks.exe
1896	schtasks.exe
1260	schtasks.exe
1156	schtasks.exe
3116	schtasks.exe
4480	schtasks.exe
4868	schtasks.exe
4876	schtasks.exe
592	schtasks.exe
1432	schtasks.exe
192	schtasks.exe
4884	schtasks.exe
4820	schtasks.exe
2228	schtasks.exe
4508	schtasks.exe
776	schtasks.exe
676	schtasks.exe
1228	schtasks.exe
1160	schtasks.exe
3316	schtasks.exe
4836	schtasks.exe
4800	schtasks.exe
220	schtasks.exe
3916	schtasks.exe
2800	schtasks.exe
4288	schtasks.exe
4896	schtasks.exe
1712	schtasks.exe
3440	schtasks.exe
200	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
3248	DllCommonsvc.exe
2816	powershell.exe
2816	powershell.exe
2600	powershell.exe
2600	powershell.exe
3212	powershell.exe
3212	powershell.exe
1832	powershell.exe
1832	powershell.exe
1900	powershell.exe
1900	powershell.exe
68	powershell.exe
68	powershell.exe
2420	powershell.exe
2420	powershell.exe
3960	powershell.exe
3960	powershell.exe
2624	powershell.exe
2624	powershell.exe
5076	powershell.exe
5076	powershell.exe
5064	powershell.exe
5064	powershell.exe
4812	powershell.exe
4812	powershell.exe
2252	powershell.exe
2252	powershell.exe
2420	powershell.exe
3172	powershell.exe
3172	powershell.exe
1972	powershell.exe
1972	powershell.exe
3960	powershell.exe
3172	powershell.exe
2980	dwm.exe
2980	dwm.exe
1972	powershell.exe
2816	powershell.exe
2816	powershell.exe
2420	powershell.exe
2600	powershell.exe
3960	powershell.exe
3212	powershell.exe
3172	powershell.exe
1832	powershell.exe
1900	powershell.exe
68	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	dwm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	DllCommonsvc.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	68	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2980	dwm.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeIncreaseQuotaPrivilege	2420	powershell.exe
Token: SeSecurityPrivilege	2420	powershell.exe
Token: SeTakeOwnershipPrivilege	2420	powershell.exe
Token: SeLoadDriverPrivilege	2420	powershell.exe
Token: SeSystemProfilePrivilege	2420	powershell.exe
Token: SeSystemtimePrivilege	2420	powershell.exe
Token: SeProfSingleProcessPrivilege	2420	powershell.exe
Token: SeIncBasePriorityPrivilege	2420	powershell.exe
Token: SeCreatePagefilePrivilege	2420	powershell.exe
Token: SeBackupPrivilege	2420	powershell.exe
Token: SeRestorePrivilege	2420	powershell.exe
Token: SeShutdownPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeSystemEnvironmentPrivilege	2420	powershell.exe
Token: SeRemoteShutdownPrivilege	2420	powershell.exe
Token: SeUndockPrivilege	2420	powershell.exe
Token: SeManageVolumePrivilege	2420	powershell.exe
Token: 33	2420	powershell.exe
Token: 34	2420	powershell.exe
Token: 35	2420	powershell.exe
Token: 36	2420	powershell.exe
Token: SeIncreaseQuotaPrivilege	3960	powershell.exe
Token: SeSecurityPrivilege	3960	powershell.exe
Token: SeTakeOwnershipPrivilege	3960	powershell.exe
Token: SeLoadDriverPrivilege	3960	powershell.exe
Token: SeSystemProfilePrivilege	3960	powershell.exe
Token: SeSystemtimePrivilege	3960	powershell.exe
Token: SeProfSingleProcessPrivilege	3960	powershell.exe
Token: SeIncBasePriorityPrivilege	3960	powershell.exe
Token: SeCreatePagefilePrivilege	3960	powershell.exe
Token: SeBackupPrivilege	3960	powershell.exe
Token: SeRestorePrivilege	3960	powershell.exe
Token: SeShutdownPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeSystemEnvironmentPrivilege	3960	powershell.exe
Token: SeRemoteShutdownPrivilege	3960	powershell.exe
Token: SeUndockPrivilege	3960	powershell.exe
Token: SeManageVolumePrivilege	3960	powershell.exe
Token: 33	3960	powershell.exe
Token: 34	3960	powershell.exe
Token: 35	3960	powershell.exe
Token: 36	3960	powershell.exe
Token: SeIncreaseQuotaPrivilege	3172	powershell.exe
Token: SeSecurityPrivilege	3172	powershell.exe
Token: SeTakeOwnershipPrivilege	3172	powershell.exe
Token: SeLoadDriverPrivilege	3172	powershell.exe
Token: SeSystemProfilePrivilege	3172	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 5100	2248	81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe	66
PID 2248 wrote to memory of 5100	2248	81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe	66
PID 2248 wrote to memory of 5100	2248	81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe	66
PID 5100 wrote to memory of 4516	5100	WScript.exe	67
PID 5100 wrote to memory of 4516	5100	WScript.exe	67
PID 5100 wrote to memory of 4516	5100	WScript.exe	67
PID 4516 wrote to memory of 3248	4516	cmd.exe	69
PID 4516 wrote to memory of 3248	4516	cmd.exe	69
PID 3248 wrote to memory of 2816	3248	DllCommonsvc.exe	113
PID 3248 wrote to memory of 2816	3248	DllCommonsvc.exe	113
PID 3248 wrote to memory of 2600	3248	DllCommonsvc.exe	118
PID 3248 wrote to memory of 2600	3248	DllCommonsvc.exe	118
PID 3248 wrote to memory of 3212	3248	DllCommonsvc.exe	115
PID 3248 wrote to memory of 3212	3248	DllCommonsvc.exe	115
PID 3248 wrote to memory of 1832	3248	DllCommonsvc.exe	116
PID 3248 wrote to memory of 1832	3248	DllCommonsvc.exe	116
PID 3248 wrote to memory of 1900	3248	DllCommonsvc.exe	119
PID 3248 wrote to memory of 1900	3248	DllCommonsvc.exe	119
PID 3248 wrote to memory of 68	3248	DllCommonsvc.exe	120
PID 3248 wrote to memory of 68	3248	DllCommonsvc.exe	120
PID 3248 wrote to memory of 2624	3248	DllCommonsvc.exe	121
PID 3248 wrote to memory of 2624	3248	DllCommonsvc.exe	121
PID 3248 wrote to memory of 2420	3248	DllCommonsvc.exe	139
PID 3248 wrote to memory of 2420	3248	DllCommonsvc.exe	139
PID 3248 wrote to memory of 3960	3248	DllCommonsvc.exe	122
PID 3248 wrote to memory of 3960	3248	DllCommonsvc.exe	122
PID 3248 wrote to memory of 5064	3248	DllCommonsvc.exe	137
PID 3248 wrote to memory of 5064	3248	DllCommonsvc.exe	137
PID 3248 wrote to memory of 5076	3248	DllCommonsvc.exe	124
PID 3248 wrote to memory of 5076	3248	DllCommonsvc.exe	124
PID 3248 wrote to memory of 4812	3248	DllCommonsvc.exe	125
PID 3248 wrote to memory of 4812	3248	DllCommonsvc.exe	125
PID 3248 wrote to memory of 2252	3248	DllCommonsvc.exe	127
PID 3248 wrote to memory of 2252	3248	DllCommonsvc.exe	127
PID 3248 wrote to memory of 3172	3248	DllCommonsvc.exe	128
PID 3248 wrote to memory of 3172	3248	DllCommonsvc.exe	128
PID 3248 wrote to memory of 1972	3248	DllCommonsvc.exe	131
PID 3248 wrote to memory of 1972	3248	DllCommonsvc.exe	131
PID 3248 wrote to memory of 2980	3248	DllCommonsvc.exe	133
PID 3248 wrote to memory of 2980	3248	DllCommonsvc.exe	133

C:\Users\Admin\AppData\Local\Temp\81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe
"C:\Users\Admin\AppData\Local\Temp\81b22a48392cbf9a0901095a3b87a7a6b2eca0eb50d60d38441b9b51c98a0b1a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:68
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\ShellExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Java\Java Update\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
    - - C:\Recovery\WindowsRE\dwm.exe
        
        "C:\Recovery\WindowsRE\dwm.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\addins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\odt\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\providercommon\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\odt\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fe800c61c7b4171b50f1612ca18c5fc9

SHA1
1ccbe95bc94f612e3cf93b4c2eb734448200cc70

SHA256
40a98fc3e6f90e07828b61c24d43c8eecd54180d08d1caaf0d714f4547392550

SHA512
d6ce4d0af52dd3bf4f044c44db300f515667adc9bdd3116c8ef7660f2953cbc4dfa3b51f3bf6d90b5ddec642b5914517b7ecbe8c33edc6f2583711c267b897ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fe800c61c7b4171b50f1612ca18c5fc9

SHA1
1ccbe95bc94f612e3cf93b4c2eb734448200cc70

SHA256
40a98fc3e6f90e07828b61c24d43c8eecd54180d08d1caaf0d714f4547392550

SHA512
d6ce4d0af52dd3bf4f044c44db300f515667adc9bdd3116c8ef7660f2953cbc4dfa3b51f3bf6d90b5ddec642b5914517b7ecbe8c33edc6f2583711c267b897ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fe800c61c7b4171b50f1612ca18c5fc9

SHA1
1ccbe95bc94f612e3cf93b4c2eb734448200cc70

SHA256
40a98fc3e6f90e07828b61c24d43c8eecd54180d08d1caaf0d714f4547392550

SHA512
d6ce4d0af52dd3bf4f044c44db300f515667adc9bdd3116c8ef7660f2953cbc4dfa3b51f3bf6d90b5ddec642b5914517b7ecbe8c33edc6f2583711c267b897ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
478bd3fba99199f509afe8410ff6d877

SHA1
4a549e5bbe0162a10f2852c274040ab628678839

SHA256
0685eb7432659362a617f3731ca838a38f08d605db7680bc070b8587fc086222

SHA512
4c82614a8858293e4d5631e4e3d6015fbc8ae4d05dbc44efcffa9b1d115b8ac62a59fe5de62904213557d65a287ea3f2ac2c1546abaae72a3b028697ce75fd4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
478bd3fba99199f509afe8410ff6d877

SHA1
4a549e5bbe0162a10f2852c274040ab628678839

SHA256
0685eb7432659362a617f3731ca838a38f08d605db7680bc070b8587fc086222

SHA512
4c82614a8858293e4d5631e4e3d6015fbc8ae4d05dbc44efcffa9b1d115b8ac62a59fe5de62904213557d65a287ea3f2ac2c1546abaae72a3b028697ce75fd4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
465f86dc0c6316d13c997ee43ca41554

SHA1
5f9fb079150c1be102071287bc3d634e2eda2ad0

SHA256
36fb64cdf3172cb2affcda285fda4cc20aeca70012c8451002580db7e13a74b6

SHA512
675490dae644996f57df6a432b86245630e97513e7a8a3a51624bf4aa86e16538eb249cefaa56c6b5909b8af6f7ebcc0c1262bbfcadbbf764c604156e938795b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
104B

MD5
e4bf071ab433d6238eedd9fbcfb4ad84

SHA1
7398127dcf8e69a882db5afef5e36c42e20ab3b7

SHA256
6396dcddfb765b5c94ba0ee4959ffd7dd21b86377af425e0fd93094ffea36ade

SHA512
a8ac36a1e625e51c8e2e93f0dcfca95d4f815304d00f46c024d7ef4ba6f77fbf5b1533efc8f22a7065ea0c7f3eb57cd7570d5af0e649a313e1c1ccef629d4694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b557777144702e0989639b560ada7b50

SHA1
82219ac09887819c4fe7456c30b4dc160b033165

SHA256
3459de54fcc4000b5ba506c09d37cd497b03c0b4c6c0e18add17d68a01c533ba

SHA512
114cd9402913e4ebbaefc74b8a2db6a17d5f82239f8be375f9106bc71918860c5518cf85956143ae77ae080706ad8b99809a03ec123aafdc03a1108d641d3e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b557777144702e0989639b560ada7b50

SHA1
82219ac09887819c4fe7456c30b4dc160b033165

SHA256
3459de54fcc4000b5ba506c09d37cd497b03c0b4c6c0e18add17d68a01c533ba

SHA512
114cd9402913e4ebbaefc74b8a2db6a17d5f82239f8be375f9106bc71918860c5518cf85956143ae77ae080706ad8b99809a03ec123aafdc03a1108d641d3e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
147130cfdbe45cc238ab9f16c47cfb52

SHA1
fc1fd6567b73a26e5b17bb28fafc108f6355d4c9

SHA256
ea6c34661f4e938537b04f60c59b64e10c6b45e2293d3d6d2713137ca1923408

SHA512
0a58faa4416476b336e48e66ef211a0539715b182af553a4e344f327c0be78742e3173274709a5f21ddee22c4464d522972de20fd81d1a2253245f73fe5495a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
457ce76b066407f8195d26e3a2e7dccc

SHA1
bc033b76c3cda6ccc915a6b6f62b4da6747d012f

SHA256
eabef6193b345a8546271b1630dd4db6636fcd3d98a793abf4160f737a92fff5

SHA512
98c0d8aa94b2866bf62ab9dacf99d763ed07a681fbd7bd879006a2ee676b281b4d907c38897095f4419f1bca0d580447ef9f5b9e478cde59356a0662d77e06f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9b47d715f5f2d5e093f8931b1fb35ad8

SHA1
51429c84e1f9a7a52233db22c9ee11d5b52d0d0b

SHA256
8f23cecd4df1b3aca38a713acdd2c92508ca386aef7f0a41922afdf3faab00ad

SHA512
7e144d66532f41068e89e3c6edf10646b2091d7ff97e99ffad80c89bbf56c20f17f54f1e9021506508029acf054487d188566d2cf5f79e7ec0ebc4cac591fc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a2db466521f45517a7336d326f757c41

SHA1
24c318e505812b5d34acf563f770a141ec82550d

SHA256
c788d4ee500fd8ad2fc569149040c63e0658cbaf87b8e6cbd7e9b35223e102e1

SHA512
b6e232537c4ae08a5322c86fb8fdefa436c926ca4c4695df242bbbaf031758637e3358d84efad41c3c7c2d40b461b6dcd26a378472b442bb3dc28213c248e73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71bceaa011800db0f2f05077ee3bf463

SHA1
db45bf581e501c6fd86d3208ef4d6c5179c4b5b7

SHA256
9a3130d6ed1be8ff792270d6dbd598b10cf39736a0336f794a5428db365a7dce

SHA512
2b209229676cd9b6b411cc9142613b84f7dca6ea70f1c27b4028d1f6cd180b0d56a76391da47adcaccb9fe947f19fd3f3d567bdca19d18ab2c6b36eaa08a8a59

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2248-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2248-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2816-367-0x000001BBEF8B0000-0x000001BBEF8D2000-memory.dmp

Filesize
136KB

Download
memory/2980-368-0x0000000001060000-0x0000000001072000-memory.dmp

Filesize
72KB

Download
memory/3248-288-0x000000001B750000-0x000000001B75C000-memory.dmp

Filesize
48KB

Download
memory/3248-284-0x0000000000AE0000-0x0000000000BF0000-memory.dmp

Filesize
1.1MB

Download
memory/3248-285-0x00000000014A0000-0x00000000014B2000-memory.dmp

Filesize
72KB

Download
memory/3248-286-0x000000001B740000-0x000000001B74C000-memory.dmp

Filesize
48KB

Download
memory/3248-287-0x00000000014B0000-0x00000000014BC000-memory.dmp

Filesize
48KB

Download
memory/3960-374-0x000001C9EB030000-0x000001C9EB0A6000-memory.dmp

Filesize
472KB

Download
memory/5100-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/5100-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download