dcrat | 9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190

Analysis

max time kernel
146s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe
Size

1.3MB
MD5

dc2a6eef500898ad5308a7a00ee3b70a
SHA1

d1c8c5346d4b1e7f79dcb89b2c492302ca5130d3
SHA256

9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190
SHA512

e28cf285cd054786f2e00fc0d1adaaf593e8335ee88ce675e414b229fcd837fd253bf08330fb96b460a52e9cf986120bcdebbf0a17764e86c3b57e29ef407487
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	3020	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3020	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	3020	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	3020	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3020	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3020	schtasks.exe	70

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac1e-282.dat	dcrat
behavioral1/files/0x000800000001ac1e-283.dat	dcrat
behavioral1/memory/1836-284-0x0000000000C80000-0x0000000000D90000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac26-402.dat	dcrat
behavioral1/files/0x000600000001ac26-403.dat	dcrat
behavioral1/files/0x000600000001ac26-410.dat	dcrat
behavioral1/files/0x000600000001ac26-416.dat	dcrat
behavioral1/files/0x000600000001ac26-421.dat	dcrat
behavioral1/files/0x000600000001ac26-427.dat	dcrat
behavioral1/files/0x000600000001ac26-432.dat	dcrat
behavioral1/files/0x000600000001ac26-438.dat	dcrat
behavioral1/files/0x000600000001ac26-444.dat	dcrat
behavioral1/files/0x000600000001ac26-450.dat	dcrat
behavioral1/files/0x000600000001ac26-455.dat	dcrat
behavioral1/files/0x000600000001ac26-460.dat	dcrat
behavioral1/files/0x000600000001ac26-466.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
1836	DllCommonsvc.exe
4796	DllCommonsvc.exe
1256	DllCommonsvc.exe
4936	DllCommonsvc.exe
3700	DllCommonsvc.exe
4992	DllCommonsvc.exe
4500	DllCommonsvc.exe
2164	DllCommonsvc.exe
2632	DllCommonsvc.exe
4496	DllCommonsvc.exe
4588	DllCommonsvc.exe
300	DllCommonsvc.exe
4428	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\a76d7bf15d8370	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4680	schtasks.exe
5104	schtasks.exe
5076	schtasks.exe
3180	schtasks.exe
3172	schtasks.exe
3248	schtasks.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1836	DllCommonsvc.exe
1836	DllCommonsvc.exe
1836	DllCommonsvc.exe
1836	DllCommonsvc.exe
1836	DllCommonsvc.exe
4140	powershell.exe
5000	powershell.exe
4140	powershell.exe
4348	powershell.exe
5000	powershell.exe
4348	powershell.exe
4140	powershell.exe
5000	powershell.exe
4348	powershell.exe
4796	DllCommonsvc.exe
1256	DllCommonsvc.exe
4936	DllCommonsvc.exe
3700	DllCommonsvc.exe
4992	DllCommonsvc.exe
4500	DllCommonsvc.exe
2164	DllCommonsvc.exe
2632	DllCommonsvc.exe
4496	DllCommonsvc.exe
4588	DllCommonsvc.exe
300	DllCommonsvc.exe
4428	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	DllCommonsvc.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeIncreaseQuotaPrivilege	4348	powershell.exe
Token: SeSecurityPrivilege	4348	powershell.exe
Token: SeTakeOwnershipPrivilege	4348	powershell.exe
Token: SeLoadDriverPrivilege	4348	powershell.exe
Token: SeSystemProfilePrivilege	4348	powershell.exe
Token: SeSystemtimePrivilege	4348	powershell.exe
Token: SeProfSingleProcessPrivilege	4348	powershell.exe
Token: SeIncBasePriorityPrivilege	4348	powershell.exe
Token: SeCreatePagefilePrivilege	4348	powershell.exe
Token: SeBackupPrivilege	4348	powershell.exe
Token: SeRestorePrivilege	4348	powershell.exe
Token: SeShutdownPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeSystemEnvironmentPrivilege	4348	powershell.exe
Token: SeRemoteShutdownPrivilege	4348	powershell.exe
Token: SeUndockPrivilege	4348	powershell.exe
Token: SeManageVolumePrivilege	4348	powershell.exe
Token: 33	4348	powershell.exe
Token: 34	4348	powershell.exe
Token: 35	4348	powershell.exe
Token: 36	4348	powershell.exe
Token: SeIncreaseQuotaPrivilege	4140	powershell.exe
Token: SeSecurityPrivilege	4140	powershell.exe
Token: SeTakeOwnershipPrivilege	4140	powershell.exe
Token: SeLoadDriverPrivilege	4140	powershell.exe
Token: SeSystemProfilePrivilege	4140	powershell.exe
Token: SeSystemtimePrivilege	4140	powershell.exe
Token: SeProfSingleProcessPrivilege	4140	powershell.exe
Token: SeIncBasePriorityPrivilege	4140	powershell.exe
Token: SeCreatePagefilePrivilege	4140	powershell.exe
Token: SeBackupPrivilege	4140	powershell.exe
Token: SeRestorePrivilege	4140	powershell.exe
Token: SeShutdownPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeSystemEnvironmentPrivilege	4140	powershell.exe
Token: SeRemoteShutdownPrivilege	4140	powershell.exe
Token: SeUndockPrivilege	4140	powershell.exe
Token: SeManageVolumePrivilege	4140	powershell.exe
Token: 33	4140	powershell.exe
Token: 34	4140	powershell.exe
Token: 35	4140	powershell.exe
Token: 36	4140	powershell.exe
Token: SeIncreaseQuotaPrivilege	5000	powershell.exe
Token: SeSecurityPrivilege	5000	powershell.exe
Token: SeTakeOwnershipPrivilege	5000	powershell.exe
Token: SeLoadDriverPrivilege	5000	powershell.exe
Token: SeSystemProfilePrivilege	5000	powershell.exe
Token: SeSystemtimePrivilege	5000	powershell.exe
Token: SeProfSingleProcessPrivilege	5000	powershell.exe
Token: SeIncBasePriorityPrivilege	5000	powershell.exe
Token: SeCreatePagefilePrivilege	5000	powershell.exe
Token: SeBackupPrivilege	5000	powershell.exe
Token: SeRestorePrivilege	5000	powershell.exe
Token: SeShutdownPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeSystemEnvironmentPrivilege	5000	powershell.exe
Token: SeRemoteShutdownPrivilege	5000	powershell.exe
Token: SeUndockPrivilege	5000	powershell.exe
Token: SeManageVolumePrivilege	5000	powershell.exe
Token: 33	5000	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4904	3528	9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe	66
PID 3528 wrote to memory of 4904	3528	9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe	66
PID 3528 wrote to memory of 4904	3528	9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe	66
PID 4904 wrote to memory of 3964	4904	WScript.exe	67
PID 4904 wrote to memory of 3964	4904	WScript.exe	67
PID 4904 wrote to memory of 3964	4904	WScript.exe	67
PID 3964 wrote to memory of 1836	3964	cmd.exe	69
PID 3964 wrote to memory of 1836	3964	cmd.exe	69
PID 1836 wrote to memory of 5000	1836	DllCommonsvc.exe	77
PID 1836 wrote to memory of 5000	1836	DllCommonsvc.exe	77
PID 1836 wrote to memory of 4140	1836	DllCommonsvc.exe	78
PID 1836 wrote to memory of 4140	1836	DllCommonsvc.exe	78
PID 1836 wrote to memory of 4348	1836	DllCommonsvc.exe	79
PID 1836 wrote to memory of 4348	1836	DllCommonsvc.exe	79
PID 1836 wrote to memory of 400	1836	DllCommonsvc.exe	83
PID 1836 wrote to memory of 400	1836	DllCommonsvc.exe	83
PID 400 wrote to memory of 2004	400	cmd.exe	85
PID 400 wrote to memory of 2004	400	cmd.exe	85
PID 400 wrote to memory of 4796	400	cmd.exe	87
PID 400 wrote to memory of 4796	400	cmd.exe	87
PID 4796 wrote to memory of 3992	4796	DllCommonsvc.exe	88
PID 4796 wrote to memory of 3992	4796	DllCommonsvc.exe	88
PID 3992 wrote to memory of 3716	3992	cmd.exe	90
PID 3992 wrote to memory of 3716	3992	cmd.exe	90
PID 3992 wrote to memory of 1256	3992	cmd.exe	91
PID 3992 wrote to memory of 1256	3992	cmd.exe	91
PID 1256 wrote to memory of 4896	1256	DllCommonsvc.exe	93
PID 1256 wrote to memory of 4896	1256	DllCommonsvc.exe	93
PID 4896 wrote to memory of 3576	4896	cmd.exe	94
PID 4896 wrote to memory of 3576	4896	cmd.exe	94
PID 4896 wrote to memory of 4936	4896	cmd.exe	95
PID 4896 wrote to memory of 4936	4896	cmd.exe	95
PID 4936 wrote to memory of 4844	4936	DllCommonsvc.exe	98
PID 4936 wrote to memory of 4844	4936	DllCommonsvc.exe	98
PID 4844 wrote to memory of 4276	4844	cmd.exe	97
PID 4844 wrote to memory of 4276	4844	cmd.exe	97
PID 4844 wrote to memory of 3700	4844	cmd.exe	99
PID 4844 wrote to memory of 3700	4844	cmd.exe	99
PID 3700 wrote to memory of 4616	3700	DllCommonsvc.exe	102
PID 3700 wrote to memory of 4616	3700	DllCommonsvc.exe	102
PID 4616 wrote to memory of 3244	4616	cmd.exe	100
PID 4616 wrote to memory of 3244	4616	cmd.exe	100
PID 4616 wrote to memory of 4992	4616	cmd.exe	103
PID 4616 wrote to memory of 4992	4616	cmd.exe	103
PID 4992 wrote to memory of 1352	4992	DllCommonsvc.exe	105
PID 4992 wrote to memory of 1352	4992	DllCommonsvc.exe	105
PID 1352 wrote to memory of 4556	1352	cmd.exe	106
PID 1352 wrote to memory of 4556	1352	cmd.exe	106
PID 1352 wrote to memory of 4500	1352	cmd.exe	107
PID 1352 wrote to memory of 4500	1352	cmd.exe	107
PID 4500 wrote to memory of 4692	4500	DllCommonsvc.exe	108
PID 4500 wrote to memory of 4692	4500	DllCommonsvc.exe	108
PID 4692 wrote to memory of 2228	4692	cmd.exe	110
PID 4692 wrote to memory of 2228	4692	cmd.exe	110
PID 4692 wrote to memory of 2164	4692	cmd.exe	111
PID 4692 wrote to memory of 2164	4692	cmd.exe	111
PID 2164 wrote to memory of 2484	2164	DllCommonsvc.exe	112
PID 2164 wrote to memory of 2484	2164	DllCommonsvc.exe	112
PID 2484 wrote to memory of 2720	2484	cmd.exe	114
PID 2484 wrote to memory of 2720	2484	cmd.exe	114
PID 2484 wrote to memory of 2632	2484	cmd.exe	115
PID 2484 wrote to memory of 2632	2484	cmd.exe	115
PID 2632 wrote to memory of 1144	2632	DllCommonsvc.exe	116
PID 2632 wrote to memory of 1144	2632	DllCommonsvc.exe	116

C:\Users\Admin\AppData\Local\Temp\9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe
"C:\Users\Admin\AppData\Local\Temp\9309a695487c1428fcbb822c1ce175bb003219c4267b55328be99d36ec875190.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KHyslkFIOf.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:400
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2004
      - C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I4yJNRBzAA.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3716
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2RP5SY0RjS.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3576
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\83zFD3riGi.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4556
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yTz6y56Ktd.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2228
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2720
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat"
        21⤵
        
        PID:1144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4376
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat"
        23⤵
        
        PID:2732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:688
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uSow6ZWML2.bat"
        25⤵
        
        PID:1432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1452
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F8wGhM86rN.bat"
        27⤵
        
        PID:3056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4892
        
        C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
        29⤵
        
        PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4276

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3244

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b50e29346799a5f3f8161ff95cf57e34

SHA1
a6b4403044730b12bdf392679ec472d212c1f27d

SHA256
a61809345cc3ca5c8a29772179318f3340f6cad3ec68230af2bb51ed33f84e8a

SHA512
89be88ab5fcdc7b7f6bd0391af0cf07a5576ff9ed99b25bf7b22ba0503befddadf2c4289e3d7cfdacc3664e63cd29d7fdc3c11a97981e5b30dc4316a0ab1cbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2RP5SY0RjS.bat

Filesize
232B

MD5
a953c78d63f7b66d161095c88f7aac6c

SHA1
51742a49d09d5ec7722cdd8ab69c2b4121d6f844

SHA256
28d08d0f57d4744e631b019a4b99ee46e33a8e3592b183d572e66e1ce99b1021

SHA512
2953b857882d98b49099f0f45219e560429267e9ffe525d98c0ab4cf43eca6ae9281fc7614b213c6e898ef35ab2f2d99b287ca53a05f80e5fefccb43a5d690eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat

Filesize
232B

MD5
612a725867c195d20ec284b6fc9a6a41

SHA1
a52e6426e63fefc5287083721182ad9ab7b05c86

SHA256
67b310bfe037d88320d8d45d22a325e9b4c17b6442badbb765f34e91bbea94cc

SHA512
02db33cfb87e2f5a8a86fff8ad04439d264113cfa4617c561f09e96ecfed5af0d121c33ac0ab5d1d852878573a72e5a6bb8cc26a6dabde7fd08c03309344fe2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\83zFD3riGi.bat

Filesize
232B

MD5
aa583f294190b20cd372143b1d213a5c

SHA1
7da3031f3c9bc54e87b7ce9497fe2946e3d5c87b

SHA256
b105c9c0b3c8789b112222734f2da371cdcbdee8e7c452fcd120bf1e1e318fc6

SHA512
80871f12690648574ff7a809cefa8dca0122ad7ae83841e2ac87ffdc88fab4b822f2d7d8b028ac3aec1f3c80fa63dca5606c6f211cdc4da0b4a51e795602ffda

Download Submit
C:\Users\Admin\AppData\Local\Temp\F8wGhM86rN.bat

Filesize
232B

MD5
8e2d31c1402fcbcbe7121a73d7df6232

SHA1
c5a00ce87b0c56f7276140e4018c7a205a34c1a4

SHA256
f1a83b6d9f74e06a7d2b97323ce83c1cdc48109d62367004eb4bf4e12600c134

SHA512
4cb959b254d51760f124cab28f178102f20b9692050b3edaea8c191ee5a4b7c60af7eb453ce3818795968ee4becb323767f57a1547c37712947339b52ad02040

Download Submit
C:\Users\Admin\AppData\Local\Temp\I4yJNRBzAA.bat

Filesize
232B

MD5
fe8a6ad785d077c81482e89cdd2eded7

SHA1
93af0c32405d86015078e8fffe2685667b2d7980

SHA256
e9d5345cb1cff763a8c3ba331c79f9b871af25575d3941b14c32c59340599339

SHA512
68ffa1e746884f89f84cd8496b34f931eb33a6da98c8fc31e5148f81148ab1132b59f5e322610f644e61e7c6e87b53890c1791284a4b3bf866d8080896603f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\KHyslkFIOf.bat

Filesize
232B

MD5
35e35210ba76ffb658da4f5a92884c1d

SHA1
1ffdb7c06ff7174ec2fd92d6d7f99532e9e5bccd

SHA256
8b0938a8806186193d0425e11724520d920a13e8c876dedd422761d30627fa88

SHA512
e1a06270ca66e577d5e78672b18620ca883043315848b24d695ba58cdb0127c65304454d5ad6044ed147c038ac395deb1508d47bd9bbf4719efcae0cfad39e1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat

Filesize
232B

MD5
0c5a2e475859bb9f57d84b96be7821f3

SHA1
1d7029b31a8c1cd0d72510d2021a686bb9036a24

SHA256
20f90651a4da7c635f15065845737e9fc3d9f626fb6905d36bdddf2d7f8bd006

SHA512
ce4b801c58cbce19f2b59cb2e9c508ab13688eca7c394f8b1243650f2e4bf4e08855e4503550f2af778599ffe405a91c6b2bc386c7760384f419a92db2281c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat

Filesize
232B

MD5
d418e42068ea0d25e7e3f53e57940c8f

SHA1
4585d9a1450123610517986337e440300ae7cfd1

SHA256
a790703a7bc3d13214beb87dbd889b899c0aa70841b5e52fcee28d30682137fc

SHA512
cd912398d32cea23eb4e772a805f8c4f1e8647a7ef343932abe08e784bd03d389ba3cd62dd322c61ded47b751bd20ab861b2e1292006bbc2814ddc6573d6dcfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat

Filesize
232B

MD5
3dfc08ee412166d34c9baba7ea2e2739

SHA1
507d2749c4e29f37517f8160bb0e6710d70bd563

SHA256
2c0564da2d9e0e256677213fbf41a7a74548231eb0691a2eb89362911b3a5ff1

SHA512
9c767396e6bfdbec8f5c36a6b86eb8ab7ae4f535e1826e7276fbdfd2423b7d39224e02f7094b92e701d063c16d6db82d9d2e55c2662ca7c11a3b631aaaafb836

Download Submit
C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat

Filesize
232B

MD5
7605b5d176da6613d2acb662bb6ed053

SHA1
93938e415adaf5cb42128cdd5e2815da6651eb93

SHA256
77dde4ca2e1a1c6e6fce02a02a6d541c80063675a2775faa6723730da85742a0

SHA512
eedcbab9d5b6572b97f54bcd38cae4798c3987a7e10df2f27830d8e47c08d8b6d29b88b3ca93d5b0d715cd673098875a76f7405c0ec33dd28452322299e528ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\uSow6ZWML2.bat

Filesize
232B

MD5
b6a7c2c8e12c215d3d1b74daae6d1321

SHA1
1973297073923da34542d03480c284d718f18db0

SHA256
2e6d878d6d0ea2358e6ff4e113e10246091ead90311677a3e9752ef5958b3864

SHA512
73d3a48893225c3751bca71fa8f394adb8a442121eba68c1c22333e61d4d08f648c1e470fee0ec8c0a8d82db2bd972110d4875596b804efd0d035fc263a93254

Download Submit
C:\Users\Admin\AppData\Local\Temp\yTz6y56Ktd.bat

Filesize
232B

MD5
4f15625b80872aace0c85f8c4e8a0991

SHA1
a17e8496e2790ec4067264ef3425e1420ef9ee81

SHA256
368f832513404aeac139c71c896d6164f8c2147a5c9c3d724192fbfaf0d353ea

SHA512
ba699b8f02b8e5118774430fafffa9195cbdedef4cd646f9a856ee1d465041b7633cd58e09e72349ff4c9ec32e3f5abdb8ad5dda4e4151c4fa295a31e24029b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

Filesize
232B

MD5
f2445edc57394209b7540dbcb1b3a14f

SHA1
4961291a9efafd9a312c3bcb4bfcd23038f0dec2

SHA256
2b55efcab21e8f8feb4f5adb7cdf7901a1a6b0c015e745b3a0705470c0fd406d

SHA512
a2d89658ed0c44df73e3f4b458308bd57a4107742d85eac19bfed2e7b04b8041bc846a54bbd6b71485e0eea7c18f6c8d637f28180f6a7328714757a94239b325

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/300-461-0x00000000010D0000-0x00000000010E2000-memory.dmp

Filesize
72KB

Download
memory/1256-411-0x000000001B6E0000-0x000000001B6F2000-memory.dmp

Filesize
72KB

Download
memory/1836-288-0x0000000001650000-0x000000000165C000-memory.dmp

Filesize
48KB

Download
memory/1836-287-0x0000000001640000-0x000000000164C000-memory.dmp

Filesize
48KB

Download
memory/1836-284-0x0000000000C80000-0x0000000000D90000-memory.dmp

Filesize
1.1MB

Download
memory/1836-285-0x00000000013A0000-0x00000000013B2000-memory.dmp

Filesize
72KB

Download
memory/1836-286-0x0000000002F10000-0x0000000002F1C000-memory.dmp

Filesize
48KB

Download
memory/2164-439-0x0000000001520000-0x0000000001532000-memory.dmp

Filesize
72KB

Download
memory/2632-445-0x0000000001590000-0x00000000015A2000-memory.dmp

Filesize
72KB

Download
memory/3528-159-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-138-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-119-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-120-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-180-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-121-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-181-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-179-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-178-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-177-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-175-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-176-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-174-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-173-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-123-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-124-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-126-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-168-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-127-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-128-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-169-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-171-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-172-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-170-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-167-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-166-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-129-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-165-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-164-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-130-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-131-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-163-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-132-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-162-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-160-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-161-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-133-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-118-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-134-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-135-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-158-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-136-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-155-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-137-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-139-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-157-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-140-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-141-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-156-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-154-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-153-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-142-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-152-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-143-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-149-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-144-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-151-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-146-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-145-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-150-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-148-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3528-147-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/3700-422-0x0000000001350000-0x0000000001362000-memory.dmp

Filesize
72KB

Download
memory/4140-311-0x0000022ACCAD0000-0x0000022ACCB46000-memory.dmp

Filesize
472KB

Download
memory/4140-304-0x0000022AB3DF0000-0x0000022AB3E12000-memory.dmp

Filesize
136KB

Download
memory/4500-433-0x0000000001790000-0x00000000017A2000-memory.dmp

Filesize
72KB

Download
memory/4796-405-0x0000000000C30000-0x0000000000C42000-memory.dmp

Filesize
72KB

Download
memory/4904-183-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download
memory/4904-184-0x0000000077550000-0x00000000776DE000-memory.dmp

Filesize
1.6MB

Download