dcrat | 13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe
Size

1.3MB
MD5

56c01f1253725415dcc2543936c03130
SHA1

35cb7dc4bba04c0dca729dcf03539ce42db43de6
SHA256

13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055
SHA512

94a47e5aa9c8cde6b449e298f3af484466b819acfcc91ef8aa5a6b7897d950f6fa1c5e800743370c9bfb64eaeb84cf9a3770d072c2b4da343bc791a184bfb927
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2068	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d69-9.dat	dcrat
behavioral1/memory/2748-13-0x0000000000140000-0x0000000000250000-memory.dmp	dcrat
behavioral1/memory/2204-106-0x0000000000B20000-0x0000000000C30000-memory.dmp	dcrat
behavioral1/memory/1432-215-0x00000000013C0000-0x00000000014D0000-memory.dmp	dcrat
behavioral1/memory/3024-394-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/2932-454-0x0000000000210000-0x0000000000320000-memory.dmp	dcrat
behavioral1/memory/2304-514-0x0000000000A70000-0x0000000000B80000-memory.dmp	dcrat
behavioral1/memory/1412-574-0x0000000000DA0000-0x0000000000EB0000-memory.dmp	dcrat
behavioral1/memory/1524-753-0x0000000000E10000-0x0000000000F20000-memory.dmp	dcrat
behavioral1/memory/600-813-0x0000000000FD0000-0x00000000010E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe
1536	powershell.exe
2692	powershell.exe
2468	powershell.exe
2620	powershell.exe
2856	powershell.exe
2368	powershell.exe
2984	powershell.exe
1780	powershell.exe
1240	powershell.exe
2932	powershell.exe
2600	powershell.exe
2316	powershell.exe
2212	powershell.exe
1072	powershell.exe
2700	powershell.exe
1540	powershell.exe
292	powershell.exe
2872	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2748	DllCommonsvc.exe
2204	cmd.exe
1432	cmd.exe
2444	cmd.exe
1976	cmd.exe
3024	cmd.exe
2932	cmd.exe
2304	cmd.exe
1412	cmd.exe
2268	cmd.exe
2756	cmd.exe
1524	cmd.exe
600	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2884	cmd.exe
2884	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
37	raw.githubusercontent.com
40	raw.githubusercontent.com
4	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\Install\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\Install\wininit.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\de-DE\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\de-DE\088424020bedd6	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2344	schtasks.exe
3024	schtasks.exe
1040	schtasks.exe
1544	schtasks.exe
1792	schtasks.exe
2800	schtasks.exe
2216	schtasks.exe
2176	schtasks.exe
2912	schtasks.exe
2136	schtasks.exe
1216	schtasks.exe
2504	schtasks.exe
1480	schtasks.exe
2952	schtasks.exe
2676	schtasks.exe
2148	schtasks.exe
1836	schtasks.exe
796	schtasks.exe
684	schtasks.exe
2436	schtasks.exe
1708	schtasks.exe
2824	schtasks.exe
1736	schtasks.exe
1648	schtasks.exe
1876	schtasks.exe
448	schtasks.exe
588	schtasks.exe
964	schtasks.exe
2408	schtasks.exe
2668	schtasks.exe
992	schtasks.exe
760	schtasks.exe
864	schtasks.exe
2880	schtasks.exe
1088	schtasks.exe
2108	schtasks.exe
1588	schtasks.exe
1356	schtasks.exe
2256	schtasks.exe
2336	schtasks.exe
2376	schtasks.exe
1640	schtasks.exe
3008	schtasks.exe
2324	schtasks.exe
1428	schtasks.exe
2392	schtasks.exe
980	schtasks.exe
2284	schtasks.exe
3048	schtasks.exe
1196	schtasks.exe
1616	schtasks.exe
3052	schtasks.exe
2860	schtasks.exe
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2748	DllCommonsvc.exe
2748	DllCommonsvc.exe
2748	DllCommonsvc.exe
292	powershell.exe
1780	powershell.exe
2692	powershell.exe
1072	powershell.exe
2368	powershell.exe
2856	powershell.exe
1240	powershell.exe
2700	powershell.exe
2648	powershell.exe
2872	powershell.exe
2468	powershell.exe
2620	powershell.exe
2204	cmd.exe
2932	powershell.exe
2212	powershell.exe
1536	powershell.exe
1540	powershell.exe
2984	powershell.exe
2316	powershell.exe
2600	powershell.exe
1432	cmd.exe
2444	cmd.exe
1976	cmd.exe
3024	cmd.exe
2932	cmd.exe
2304	cmd.exe
1412	cmd.exe
2268	cmd.exe
2756	cmd.exe
1524	cmd.exe
600	cmd.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	DllCommonsvc.exe
Token: SeDebugPrivilege	292	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2204	cmd.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1432	cmd.exe
Token: SeDebugPrivilege	2444	cmd.exe
Token: SeDebugPrivilege	1976	cmd.exe
Token: SeDebugPrivilege	3024	cmd.exe
Token: SeDebugPrivilege	2932	cmd.exe
Token: SeDebugPrivilege	2304	cmd.exe
Token: SeDebugPrivilege	1412	cmd.exe
Token: SeDebugPrivilege	2268	cmd.exe
Token: SeDebugPrivilege	2756	cmd.exe
Token: SeDebugPrivilege	1524	cmd.exe
Token: SeDebugPrivilege	600	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2268	2792	13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe	30
PID 2792 wrote to memory of 2268	2792	13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe	30
PID 2792 wrote to memory of 2268	2792	13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe	30
PID 2792 wrote to memory of 2268	2792	13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe	30
PID 2268 wrote to memory of 2884	2268	WScript.exe	31
PID 2268 wrote to memory of 2884	2268	WScript.exe	31
PID 2268 wrote to memory of 2884	2268	WScript.exe	31
PID 2268 wrote to memory of 2884	2268	WScript.exe	31
PID 2884 wrote to memory of 2748	2884	cmd.exe	33
PID 2884 wrote to memory of 2748	2884	cmd.exe	33
PID 2884 wrote to memory of 2748	2884	cmd.exe	33
PID 2884 wrote to memory of 2748	2884	cmd.exe	33
PID 2748 wrote to memory of 2600	2748	DllCommonsvc.exe	89
PID 2748 wrote to memory of 2600	2748	DllCommonsvc.exe	89
PID 2748 wrote to memory of 2600	2748	DllCommonsvc.exe	89
PID 2748 wrote to memory of 1536	2748	DllCommonsvc.exe	90
PID 2748 wrote to memory of 1536	2748	DllCommonsvc.exe	90
PID 2748 wrote to memory of 1536	2748	DllCommonsvc.exe	90
PID 2748 wrote to memory of 2212	2748	DllCommonsvc.exe	92
PID 2748 wrote to memory of 2212	2748	DllCommonsvc.exe	92
PID 2748 wrote to memory of 2212	2748	DllCommonsvc.exe	92
PID 2748 wrote to memory of 1540	2748	DllCommonsvc.exe	93
PID 2748 wrote to memory of 1540	2748	DllCommonsvc.exe	93
PID 2748 wrote to memory of 1540	2748	DllCommonsvc.exe	93
PID 2748 wrote to memory of 2620	2748	DllCommonsvc.exe	94
PID 2748 wrote to memory of 2620	2748	DllCommonsvc.exe	94
PID 2748 wrote to memory of 2620	2748	DllCommonsvc.exe	94
PID 2748 wrote to memory of 2692	2748	DllCommonsvc.exe	95
PID 2748 wrote to memory of 2692	2748	DllCommonsvc.exe	95
PID 2748 wrote to memory of 2692	2748	DllCommonsvc.exe	95
PID 2748 wrote to memory of 2700	2748	DllCommonsvc.exe	97
PID 2748 wrote to memory of 2700	2748	DllCommonsvc.exe	97
PID 2748 wrote to memory of 2700	2748	DllCommonsvc.exe	97
PID 2748 wrote to memory of 2316	2748	DllCommonsvc.exe	98
PID 2748 wrote to memory of 2316	2748	DllCommonsvc.exe	98
PID 2748 wrote to memory of 2316	2748	DllCommonsvc.exe	98
PID 2748 wrote to memory of 2468	2748	DllCommonsvc.exe	100
PID 2748 wrote to memory of 2468	2748	DllCommonsvc.exe	100
PID 2748 wrote to memory of 2468	2748	DllCommonsvc.exe	100
PID 2748 wrote to memory of 1072	2748	DllCommonsvc.exe	101
PID 2748 wrote to memory of 1072	2748	DllCommonsvc.exe	101
PID 2748 wrote to memory of 1072	2748	DllCommonsvc.exe	101
PID 2748 wrote to memory of 292	2748	DllCommonsvc.exe	102
PID 2748 wrote to memory of 292	2748	DllCommonsvc.exe	102
PID 2748 wrote to memory of 292	2748	DllCommonsvc.exe	102
PID 2748 wrote to memory of 2856	2748	DllCommonsvc.exe	103
PID 2748 wrote to memory of 2856	2748	DllCommonsvc.exe	103
PID 2748 wrote to memory of 2856	2748	DllCommonsvc.exe	103
PID 2748 wrote to memory of 1780	2748	DllCommonsvc.exe	104
PID 2748 wrote to memory of 1780	2748	DllCommonsvc.exe	104
PID 2748 wrote to memory of 1780	2748	DllCommonsvc.exe	104
PID 2748 wrote to memory of 2368	2748	DllCommonsvc.exe	106
PID 2748 wrote to memory of 2368	2748	DllCommonsvc.exe	106
PID 2748 wrote to memory of 2368	2748	DllCommonsvc.exe	106
PID 2748 wrote to memory of 1240	2748	DllCommonsvc.exe	107
PID 2748 wrote to memory of 1240	2748	DllCommonsvc.exe	107
PID 2748 wrote to memory of 1240	2748	DllCommonsvc.exe	107
PID 2748 wrote to memory of 2984	2748	DllCommonsvc.exe	109
PID 2748 wrote to memory of 2984	2748	DllCommonsvc.exe	109
PID 2748 wrote to memory of 2984	2748	DllCommonsvc.exe	109
PID 2748 wrote to memory of 2648	2748	DllCommonsvc.exe	110
PID 2748 wrote to memory of 2648	2748	DllCommonsvc.exe	110
PID 2748 wrote to memory of 2648	2748	DllCommonsvc.exe	110
PID 2748 wrote to memory of 2932	2748	DllCommonsvc.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe
"C:\Users\Admin\AppData\Local\Temp\13129962f25c4ef3f982cd46a2577375588c49c4d39067c9aecb9f3602c42055N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\es-ES\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\de-DE\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Install\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
    - - C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat"
        6⤵
        
        PID:620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:672
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"
        8⤵
        
        PID:1352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2564
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
        10⤵
        
        PID:2272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2368
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"
        12⤵
        
        PID:2260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2176
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat"
        14⤵
        
        PID:1416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1432
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
        16⤵
        
        PID:2648
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2856
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat"
        18⤵
        
        PID:588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1196
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uugdhbmYnk.bat"
        20⤵
        
        PID:2156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2628
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ouYA2TrKB.bat"
        22⤵
        
        PID:1620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2124
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Myoa8e0eVV.bat"
        24⤵
        
        PID:2112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1700
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdN2yJpTNi.bat"
        26⤵
        
        PID:2324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1464
        
        C:\Program Files\VideoLAN\cmd.exe
        
        "C:\Program Files\VideoLAN\cmd.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\SendTo\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\SendTo\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Pictures\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\de-DE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\de-DE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\de-DE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\Install\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\Install\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Saved Games\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Saved Games\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d66cb7bd97aa9488fac5db52aa07b252

SHA1
5e21bb9806c8d8a6228557c8b15bab8f92be6b6a

SHA256
706d6d46d7531d0b2f26888d566e4b7b562de639d5654ed437bc703978a62843

SHA512
b64a4199d349719a08463c5474df31724a26d502fbeeca9b8a8024fc59e7879a7090cbc2245e658d2fe8516970385417db227677f1efd4151e7001788160d0c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d773d1401bb13839e27d728a3e5b5e08

SHA1
5ee084f3eee42a86cb1b9f35eb99064b6db22155

SHA256
4137149b5fe84b89cfb1e9ad393d776ad11c13656a1a8edfb23f7a26993015df

SHA512
bc59246f725f954057ac18758e2bba2e9af12bd30c7fd9c0aef27bdb92e6e28777dacd2d4efc7127cdcdd04788ffbb5252b651ddc0edbd6bbefbfb8956c6872c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
136531e9f1437ee79922b37cd812c2e3

SHA1
881cd18d459ce0982ff5315a37d17827e51fa43d

SHA256
db2e17f266475e16b28cdc979d4839c8368858801f88f118916edcca81876411

SHA512
6f3eefa0940f1b1f989a9bdddce5ee9394a30a347f23596dfae383d76aa3ec9501b5485d4122cd0f3793d1763fe0254bda53fbbd9ac7da239fd7bcf1e0dd4fda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb8e893ec461c5b81b5e83ed8ef2948

SHA1
4c1a44a7d8689ff72cf95fa9c0f019d09644576b

SHA256
61e6c05d29d16a6cba6d179d13124b4522eead67ca7d804c7c147089633a75c2

SHA512
bd4c0cace15de1906f915a2324d9973162c8e8fdd0ebd021af26294f6c54a10e1887616eac740c02d0fb8e7cf165572fbe67276172e99f0055895bd457997c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e99cb278a8eb47a2353352e9df4c7bb5

SHA1
435afd571db4cd8eb62eda938221f4396a9413e1

SHA256
60ab06a1a6d997e3ede82f4d3c4853533782b2d021a2cb87c0dcf1781b040bab

SHA512
27c05eff58a4988f2eb6d03aa40543c7cf0cc8d9e5bbfc5e3f234e632f1dbc9737950d6a4778bc3c38728b85b87a374638e5b1fd27802d4bb733899fd2ea88a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0284cc3ad68ba6e02405a943a5346bdb

SHA1
e2744c22f5bbd24054b2d974a3f822cf382309e7

SHA256
fd1c420886fd6dc131bb9dade07368b4cd9f0971900407b265e363f2fc55aeee

SHA512
a6cc802e0decd971792467dcdcce57c9b6f18f58a452180f1236a2b0b50c6ac9f4b12c5e0490f6643b0837e96dea9541c612591e17518b75a13c1ae794295366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d97177a6909d7022aa941aae3452d9d

SHA1
afc586cdc0cba42cc6f74717502bc9508cb29e80

SHA256
a19cdcfd573e5596bf2e3875d2b54bf5ff68db6692c98052b91408279e9b64ac

SHA512
eb3ba08f8873f70d84f5489c4bb40b8c197142bc05a9dbd31e6e4b4078868729ce2720581d009e8442e5267406dac97976ee5f38aadbfa2aa9e04af50046a8ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35e3d6d560d69b76874e398575e5675

SHA1
12a63a30463b005b451864d10a86ef4c93bd193a

SHA256
498e3853a76dbcc820eb13a5c20f102476ea1c31e7b1b01ae08b491614487ac2

SHA512
7561f5ae82f11d6298d29aca07ec2b3a75d1bd25dbae53d89b0aceba0bbf272b75a3762e26c945cea616a6c30c5378c43df0c5301861d028067fba575f665ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f64927a48f2208a8396e1a9d2acbf04e

SHA1
84ca5404c048170c198be05beeecb845eea5d123

SHA256
a2034f1d75aba0a4d148223e16a0116ab6a37af5384c2f89f9d6ff9cb404ba6c

SHA512
9e161adcffaf9f93c86cde1d7b1f90cc9e57839b516b9e8d079993d7a1bcb510c62ec11dc55f70ff381b1a84d742653687b085251e6f0ccee132ee0e7b784a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b881ba65d2d4d1bc4698f0201bb78351

SHA1
60ff7b75e58ce3ffc249bf6a0508dcbcb70b8270

SHA256
327871e63fa87e81be88f949ed92696c6bf0452ff4dcd6a2348279570c966d0d

SHA512
84f08e4208c33788c52ffe3f1fb938dc423fd3461f03afc53d70dd4fc60ffd80a96ba9b57839785a6096f1781ee0327f06fc9cbe26664cac705a418cefdf2f40

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat

Filesize
198B

MD5
8f43896aa00e9987f4d529fcb73f5e80

SHA1
1473cf545bc442ff96f021b2be5b54dee6f174a2

SHA256
faa53f8e18dd27036faa5acd289e53a7dfeabe4ef40ba6c3f26ab846ee72e765

SHA512
11f26510d98fc74f69f3d2c23ba8e7d43d94e2cca0e502a216ffce1eb8f3f71307e4c2e6c08fdc9b3073efe4baa1709ca22d5cb8000b4bc753489ce9c03aa213

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ouYA2TrKB.bat

Filesize
198B

MD5
283cd9602998400571c44fcc782b82a7

SHA1
d02197ce9a183197997ba227a20a28422c11a311

SHA256
5a413557eb1e38a609827f2f14d04045f9fc733f7ca79d0c3cc9e65d51065627

SHA512
2e88f0c9fbfa3d3ae8829801c07f45d558fcb1ab7aecb72c5e7ad9a91c1c5ab2b5bad3360aed23916591d25d13e8400fb086cbd37bde4fbb6a29480001c08fb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat

Filesize
198B

MD5
1397d1af6f97926c23646ff73d02b68d

SHA1
20437638452cb0e5ebac22d3da0ceee063111aca

SHA256
8a9d58cb5c70b277bd2d997856db762ef0be17e61d463a4d75518ac0ad470030

SHA512
3e188f75a77b96a804effadfc3d50f78ce8f1dc06eb8d52c063cab743ba49e311bbf807967e14a294847fbf34aeb9d44f75a2d0934d0446400ba558f78ad4a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9DC7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat

Filesize
198B

MD5
1aec68e2b3b7002e144eb4a553d11f8b

SHA1
3fd9f6166fda14ba1502426a8d39585b63964379

SHA256
d9a35df17b4f031c8a042d303315a8d2544c91ec3e3d71c5850ac82244ca5721

SHA512
6474f692ce9d80b020f7f2de3e1bc9e4b5d7d1500aa1732162246471219c5fd226a62cf6480fc13cb83ffeed348d494fd2e3147f45f50adc1f8c7d840ca1d000

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdN2yJpTNi.bat

Filesize
198B

MD5
f935cd3e38c77e22ed6dedfe586a2fe8

SHA1
dca7595f847d556eb84478096f35dc6d7f85f66a

SHA256
41bc29fa7726dc7ad78d2613586225ea3a3facbb9619ac60eb2039a00bce26f0

SHA512
cad6927b01d5ad6d9408932d4c54c696e409acf11485de469304bfd8ac0e99e618b0bc278006748791e89e6875c4d004d38e50e1044579d39a69ec62c5998ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Myoa8e0eVV.bat

Filesize
198B

MD5
1849f4f83a1d547b32387135a5bca45c

SHA1
1e8abb1c9bdac7d0643d1b2356384c081cdb1ffc

SHA256
38a3641315732090419f234dd43b5b9e997c68f6560ef9fc48721390b8db1316

SHA512
a32908118339f88741ccfec6bbdc6005bcea9e3c734aba26a060710b433baea8e97635f5034ee01dbaf923af1c19fc7a113c1ca4a49ce47efcd0c09b980a894d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DDA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

Filesize
198B

MD5
61bbc7bd998f610a08c79f969dda9828

SHA1
4021f1df91ba15e95d2b1ab7fcfc7c4fb0228538

SHA256
26c10308c97998e3c4d91de291ce43ac7f030b82f7319520b5aecc583ef39d93

SHA512
486396c43512855deafa9108999a0683971815bfb36e29e2ad1259b42c6ad5dcb7deca68e5f2404340839b0ca4ad2354f624ae4f836e67066a055105144f0662

Download Submit
C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat

Filesize
198B

MD5
1c39a21bea504027652add9238c59639

SHA1
765cf8bc1403259d44b60be5ef95d286760be434

SHA256
65377dff6bdd8878e00c0773dbe8b109268896fc3d067ba03525ac1a4f11fc38

SHA512
548289fb93fc921431f93150028c45b3ba06731b605359f70a1d5b436f74594de2d314fb9c22525d7e27ee7c9f9e2f63694b161f730ff285b01c814c766ba3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat

Filesize
198B

MD5
68fde8fb0e20864449eb9ac6a97a7d89

SHA1
bbd87a29ea778fe0f8773d410a37c4a4f848d2fd

SHA256
4732e8c715c04ecb23d1b1b203cc4ec6806e22c81149227e95e6311ed124d080

SHA512
5742aa5c6f482d302dcb3a1ef9a376a34edc93173a4c9f04de76f0a0d1b40fe284a8d0e04d0d7aaaeeb73cbb46350136362815ac09aab7058c37eafe86bdff87

Download Submit
C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat

Filesize
198B

MD5
4ea411d6c13c6ea1a7051b6d2b99150d

SHA1
1f0d26955c05b162f5a6cd0519c0e37755e67111

SHA256
66a57196af060828b5929612e1fa3f225f47afeb463aa91bc78ccbd47907241b

SHA512
4b9fb2ad110934fa5b144463385c902b750a7e3ad8f1fcfe1f45928b01ba6a50afcaac8a6bf0ec9fd8be19731487d148a5e3a1dfa35fc8ba6e442583a5d2f8ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\uugdhbmYnk.bat

Filesize
198B

MD5
4e2905cff8d0cd62cae25b624ac95acc

SHA1
2534eaa83decd622f0b9b50a30d38c6c82786eb2

SHA256
319833533d845f42ed0c7b2d978c7965b8c0656ffcd8c1348088bf0a7aae6b47

SHA512
7566035885478e57b7bdd8db7cd212d00b2f8710358424f4d4f478497812bd807f47aa5ad882df2989abc84eefd33d310bb38c3f34e4b1eba9dac0d122a18ada

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d2ef10f0c9adcffdd55c835ba99bf2a9

SHA1
a8a3ec6f9f42c8c57eb4e6728f8afc6486a65bc5

SHA256
102656dcc66a990938c2a5f1ce9438515bf458df09b8b3222bdcc3a7cce793ef

SHA512
05b91be58e49c26b280de5867b735d30b7dc7cd22495f6097275cd1f88751e1f3f504f6630461b5f6461fdfa91bbbae2ff5d5feffe2908f9a4ace40b7d40d717

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/292-73-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/600-813-0x0000000000FD0000-0x00000000010E0000-memory.dmp

Filesize
1.1MB

Download
memory/1412-574-0x0000000000DA0000-0x0000000000EB0000-memory.dmp

Filesize
1.1MB

Download
memory/1432-216-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1432-215-0x00000000013C0000-0x00000000014D0000-memory.dmp

Filesize
1.1MB

Download
memory/1524-753-0x0000000000E10000-0x0000000000F20000-memory.dmp

Filesize
1.1MB

Download
memory/2204-106-0x0000000000B20000-0x0000000000C30000-memory.dmp

Filesize
1.1MB

Download
memory/2304-514-0x0000000000A70000-0x0000000000B80000-memory.dmp

Filesize
1.1MB

Download
memory/2692-68-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2748-17-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2748-16-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2748-15-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2748-14-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/2748-13-0x0000000000140000-0x0000000000250000-memory.dmp

Filesize
1.1MB

Download
memory/2756-693-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2932-454-0x0000000000210000-0x0000000000320000-memory.dmp

Filesize
1.1MB

Download
memory/3024-394-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download