dcrat | b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2022 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe
Size

1.3MB
MD5

123b77cbdba6713ae0c268f1f5ea0e0a
SHA1

587e9af6c8badcd157bd276fe16eb150686c1667
SHA256

b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804
SHA512

ad27ef0a6557c7f93419179759bc3708fb6fd0570c2b8f79db973f40880c5fa1ee2057a6513b4b0b43302efa41483ec5d41fac5f7606a60182f01ac4568a07f2
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	3248	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	3248	schtasks.exe	31

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e5b-137.dat	dcrat
behavioral1/files/0x0006000000022e5b-138.dat	dcrat
behavioral1/memory/1528-139-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e5d-151.dat	dcrat
behavioral1/files/0x0006000000022e5d-152.dat	dcrat
behavioral1/files/0x0006000000022e5d-191.dat	dcrat
behavioral1/files/0x0006000000022e5d-198.dat	dcrat
behavioral1/files/0x0006000000022e5d-205.dat	dcrat
behavioral1/files/0x0006000000022e5d-212.dat	dcrat
behavioral1/files/0x0006000000022e5d-219.dat	dcrat
behavioral1/files/0x0006000000022e5d-226.dat	dcrat
behavioral1/files/0x0006000000022e5d-233.dat	dcrat
behavioral1/files/0x0006000000022e5d-240.dat	dcrat
behavioral1/files/0x0006000000022e5d-247.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
1528	DllCommonsvc.exe
440	DllCommonsvc.exe
4988	DllCommonsvc.exe
4072	DllCommonsvc.exe
4256	DllCommonsvc.exe
4220	DllCommonsvc.exe
1128	DllCommonsvc.exe
5072	DllCommonsvc.exe
3828	DllCommonsvc.exe
216	DllCommonsvc.exe
1372	DllCommonsvc.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\0a1fd5f707cd16	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\debug\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\debug\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\Downloaded Program Files\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Downloaded Program Files\ebf1f9fa8afd6d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4556	schtasks.exe
5016	schtasks.exe
3008	schtasks.exe
3824	schtasks.exe
3776	schtasks.exe
1236	schtasks.exe
4892	schtasks.exe
3936	schtasks.exe
2808	schtasks.exe
3404	schtasks.exe
1556	schtasks.exe
836	schtasks.exe
688	schtasks.exe
4700	schtasks.exe
220	schtasks.exe
32	schtasks.exe
2484	schtasks.exe
1776	schtasks.exe
3228	schtasks.exe
312	schtasks.exe
1616	schtasks.exe
4672	schtasks.exe
4352	schtasks.exe
3892	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1528	DllCommonsvc.exe
1528	DllCommonsvc.exe
1528	DllCommonsvc.exe
1412	powershell.exe
4804	powershell.exe
3620	powershell.exe
3620	powershell.exe
1004	powershell.exe
1004	powershell.exe
4368	powershell.exe
4368	powershell.exe
4564	powershell.exe
4564	powershell.exe
1064	powershell.exe
1064	powershell.exe
968	powershell.exe
968	powershell.exe
1344	powershell.exe
1344	powershell.exe
1004	powershell.exe
440	DllCommonsvc.exe
440	DllCommonsvc.exe
3620	powershell.exe
4804	powershell.exe
1412	powershell.exe
1412	powershell.exe
4804	powershell.exe
4564	powershell.exe
4368	powershell.exe
968	powershell.exe
1344	powershell.exe
1064	powershell.exe
4988	DllCommonsvc.exe
4072	DllCommonsvc.exe
4256	DllCommonsvc.exe
4220	DllCommonsvc.exe
1128	DllCommonsvc.exe
5072	DllCommonsvc.exe
3828	DllCommonsvc.exe
216	DllCommonsvc.exe
1372	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	DllCommonsvc.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	440	DllCommonsvc.exe
Token: SeDebugPrivilege	4988	DllCommonsvc.exe
Token: SeDebugPrivilege	4072	DllCommonsvc.exe
Token: SeDebugPrivilege	4256	DllCommonsvc.exe
Token: SeDebugPrivilege	4220	DllCommonsvc.exe
Token: SeDebugPrivilege	1128	DllCommonsvc.exe
Token: SeDebugPrivilege	5072	DllCommonsvc.exe
Token: SeDebugPrivilege	3828	DllCommonsvc.exe
Token: SeDebugPrivilege	216	DllCommonsvc.exe
Token: SeDebugPrivilege	1372	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2296	4800	b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe	81
PID 4800 wrote to memory of 2296	4800	b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe	81
PID 4800 wrote to memory of 2296	4800	b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe	81
PID 2296 wrote to memory of 4240	2296	WScript.exe	82
PID 2296 wrote to memory of 4240	2296	WScript.exe	82
PID 2296 wrote to memory of 4240	2296	WScript.exe	82
PID 4240 wrote to memory of 1528	4240	cmd.exe	84
PID 4240 wrote to memory of 1528	4240	cmd.exe	84
PID 1528 wrote to memory of 968	1528	DllCommonsvc.exe	109
PID 1528 wrote to memory of 968	1528	DllCommonsvc.exe	109
PID 1528 wrote to memory of 1412	1528	DllCommonsvc.exe	110
PID 1528 wrote to memory of 1412	1528	DllCommonsvc.exe	110
PID 1528 wrote to memory of 3620	1528	DllCommonsvc.exe	112
PID 1528 wrote to memory of 3620	1528	DllCommonsvc.exe	112
PID 1528 wrote to memory of 4804	1528	DllCommonsvc.exe	113
PID 1528 wrote to memory of 4804	1528	DllCommonsvc.exe	113
PID 1528 wrote to memory of 1004	1528	DllCommonsvc.exe	115
PID 1528 wrote to memory of 1004	1528	DllCommonsvc.exe	115
PID 1528 wrote to memory of 1344	1528	DllCommonsvc.exe	116
PID 1528 wrote to memory of 1344	1528	DllCommonsvc.exe	116
PID 1528 wrote to memory of 4564	1528	DllCommonsvc.exe	118
PID 1528 wrote to memory of 4564	1528	DllCommonsvc.exe	118
PID 1528 wrote to memory of 4368	1528	DllCommonsvc.exe	119
PID 1528 wrote to memory of 4368	1528	DllCommonsvc.exe	119
PID 1528 wrote to memory of 1064	1528	DllCommonsvc.exe	123
PID 1528 wrote to memory of 1064	1528	DllCommonsvc.exe	123
PID 1528 wrote to memory of 440	1528	DllCommonsvc.exe	127
PID 1528 wrote to memory of 440	1528	DllCommonsvc.exe	127
PID 440 wrote to memory of 3080	440	DllCommonsvc.exe	134
PID 440 wrote to memory of 3080	440	DllCommonsvc.exe	134
PID 3080 wrote to memory of 3892	3080	cmd.exe	133
PID 3080 wrote to memory of 3892	3080	cmd.exe	133
PID 3080 wrote to memory of 4988	3080	cmd.exe	138
PID 3080 wrote to memory of 4988	3080	cmd.exe	138
PID 4988 wrote to memory of 4180	4988	DllCommonsvc.exe	141
PID 4988 wrote to memory of 4180	4988	DllCommonsvc.exe	141
PID 4180 wrote to memory of 2164	4180	cmd.exe	140
PID 4180 wrote to memory of 2164	4180	cmd.exe	140
PID 4180 wrote to memory of 4072	4180	cmd.exe	142
PID 4180 wrote to memory of 4072	4180	cmd.exe	142
PID 4072 wrote to memory of 3840	4072	DllCommonsvc.exe	143
PID 4072 wrote to memory of 3840	4072	DllCommonsvc.exe	143
PID 3840 wrote to memory of 3488	3840	cmd.exe	145
PID 3840 wrote to memory of 3488	3840	cmd.exe	145
PID 3840 wrote to memory of 4256	3840	cmd.exe	146
PID 3840 wrote to memory of 4256	3840	cmd.exe	146
PID 4256 wrote to memory of 2680	4256	DllCommonsvc.exe	147
PID 4256 wrote to memory of 2680	4256	DllCommonsvc.exe	147
PID 2680 wrote to memory of 2788	2680	cmd.exe	149
PID 2680 wrote to memory of 2788	2680	cmd.exe	149
PID 2680 wrote to memory of 4220	2680	cmd.exe	150
PID 2680 wrote to memory of 4220	2680	cmd.exe	150
PID 4220 wrote to memory of 1608	4220	DllCommonsvc.exe	151
PID 4220 wrote to memory of 1608	4220	DllCommonsvc.exe	151
PID 1608 wrote to memory of 1488	1608	cmd.exe	153
PID 1608 wrote to memory of 1488	1608	cmd.exe	153
PID 1608 wrote to memory of 1128	1608	cmd.exe	154
PID 1608 wrote to memory of 1128	1608	cmd.exe	154
PID 1128 wrote to memory of 1780	1128	DllCommonsvc.exe	155
PID 1128 wrote to memory of 1780	1128	DllCommonsvc.exe	155
PID 1780 wrote to memory of 2116	1780	cmd.exe	157
PID 1780 wrote to memory of 2116	1780	cmd.exe	157
PID 1780 wrote to memory of 5072	1780	cmd.exe	158
PID 1780 wrote to memory of 5072	1780	cmd.exe	158

C:\Users\Admin\AppData\Local\Temp\b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe
"C:\Users\Admin\AppData\Local\Temp\b74eebc0edfca32e67d40f3772e28a95547c52438ba0f4177ff0545a67665804.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
    - - C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:440
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VhvmsyECnd.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PfMhC4n1i0.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3488
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2788
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1488
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2116
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat"
        18⤵
        
        PID:4880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4148
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CxpWyGgMb4.bat"
        20⤵
        
        PID:1828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2464
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat"
        22⤵
        
        PID:4136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4344
        
        C:\odt\DllCommonsvc.exe
        
        "C:\odt\DllCommonsvc.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat"
        24⤵
        
        PID:4988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\odt\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\debug\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\Downloaded Program Files\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3892

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat

Filesize
188B

MD5
b4f5a4b48a9eec914f1c5d0aabbc21c4

SHA1
8b56392569ae6782bbf6fcedd1b82fd2b355d6c1

SHA256
f119a1629f9989fdb918b3c682d1752ac62b9c3f29c8b4cbb8cf16459a9c626b

SHA512
ca53af7111c9abd78778c544ecc6e29e924f4883cc750eef427a1f25f85f66cef7d555c4186373037a504d32425cab18409caffb86ca1fdbdbb4aec756a04d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CxpWyGgMb4.bat

Filesize
188B

MD5
409e5a57de2bbd7a42372ebb9fb873c5

SHA1
180fec2e2a37daa12685f91c615b4755639c4764

SHA256
fd839454549d58d3cd6c91bfa7801a2cd39990b2b436a8f039b50f9dc2eafb43

SHA512
4a448280f3dbde20524f4513776867ffb04580001c13cd5b95e9e066077532893cb154c278066793e2d5ac7dae1b835007a56c9de241a6f9516e6d44f5a4e611

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat

Filesize
188B

MD5
d8360dff36f118635ba0ede4b4a067cf

SHA1
06ef7a039d2ffd3f14cac6171bb7846414e94d63

SHA256
67502bd37b813322dcb4d7c9f2ac20b114f63b84dfe159005fcecb518511b772

SHA512
74da8a88eabdfb13a3ac88e9db55b521ac3e447dc8b8f2846e0a605e2273dcac575719225eadbecec01279b836d41f963bce67067868ababb2c70432002d9f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\EzDSmeWZ76.bat

Filesize
188B

MD5
585fc8d33315e6f2982a63bb27462295

SHA1
088644a6a1842b4c85c223023331243a413b9309

SHA256
5f64d20120a079a8c28abfe026738dd5c9aea759fef1c1c832bc6312a0f679c0

SHA512
142cf7d310d4341133e179f02b13b1fd9e9ae0e1adc9f0928133c76dda6aaa58439112e7ae56f135b202cbc786290905ea0bb8377a0125f4672c398b05e8d646

Download Submit
C:\Users\Admin\AppData\Local\Temp\PfMhC4n1i0.bat

Filesize
188B

MD5
62cd0e8513005b608f8498ee31cb080b

SHA1
ae41b56ad146f8a17a60bacf1210096604192f14

SHA256
d97a276b2518af253e572adcffff20ae86e48422f18208b3d2b4464c54c0871b

SHA512
79fda16175f2b1c4349c265f8ec70c2ca14a99155d31ebec6f7981278de92dbdcbb73290c1d57d6300e7451ca8ae818d7e18342641ed1ff41ef3f487f35bbc0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\VhvmsyECnd.bat

Filesize
188B

MD5
5e58ba4ddd808585a1b761bbf621a322

SHA1
d076d31abc1b483a8e9ca174ce522cd0ec333ea1

SHA256
a9b89f74c1a9445104a6e46ea659741b916e44b0b39f2ba60d99d39293194bad

SHA512
99d43024cd206813aa83278b5238520c73c5b6cf8bc35ea157eac4f5813414bce5189dee5309c865a1fa031d956d808c87b9e7d1a92595fe90b7f43d6808cd3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat

Filesize
188B

MD5
30af5f85099deb7b80da87e13e29fa66

SHA1
b9c6dcba41dc01b0dc9903cd80df0ab065cd2ed5

SHA256
a86fab8ef705a3a8337faf3136f75da7f71b4d775645bc9e05c0e5383265d7cc

SHA512
32e3bde7da8e15a3d14d587169d39dc4dc18fb2270bb7d8b963d792f5ab04bb0a8a8068439865fe3720702b9afbcea5c4f5d272ad02c4784ba5a9046d12d2806

Download Submit
C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat

Filesize
188B

MD5
2f82d7ed7915b7b8310604db6d95e34f

SHA1
68df61f53d36f2494dda5b5015ea16193339623d

SHA256
75d617b6d6f0664d557faf7878fafb8f3be2d0a3a6a7557b2ad28b61b67d4afb

SHA512
92a82140554357af1bbe6f97c59cd9bdbd6bbc96044f06937e2470f2e958d9ab2d6289171fd0db2dfe622c8b45a7e157a09a10e393307e60b25ebf49ba760b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat

Filesize
188B

MD5
57b6d0380244406dc3199fcdb9441c17

SHA1
4c06abe5d3df4471b4b4a4a77fb9955135be9884

SHA256
4dfb0121bc2d5c4af009b04a5ec9c269331f13c20241e13b57888fa11823ed86

SHA512
aa6938cc4542c2c5cc20f140e406a095ea4f441d4a59eb3326e454fc17442e75b4c51bcff672e762eaddc729edd54033674c4dcc1616bf4ceaec438925ed2ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat

Filesize
188B

MD5
62b954f43547cac6041ddd0451bf6ee7

SHA1
4053e7b0edfa25a8e64799bd0f8375c85850b39e

SHA256
60e1205acf1ea8fddf3a96a6369f8624e9a67ff61fadfa4adb5e49b827b634b2

SHA512
01501fad301464ada15a74421f15b050726c73bb0ac53388017b63e6131cdb2d7095a73a6b8c123a0f7a6191d3266ee603490d878a0b92b8417eea2e79bf0ce4

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/216-239-0x0000000000000000-mapping.dmp

Download
memory/216-241-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/216-245-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/440-164-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/440-150-0x0000000000000000-mapping.dmp

Download
memory/440-184-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/440-189-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/968-141-0x0000000000000000-mapping.dmp

Download
memory/968-160-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/968-179-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1004-175-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1004-158-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1004-145-0x0000000000000000-mapping.dmp

Download
memory/1064-172-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1064-149-0x0000000000000000-mapping.dmp

Download
memory/1064-163-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1128-220-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/1128-224-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/1128-218-0x0000000000000000-mapping.dmp

Download
memory/1344-159-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1344-146-0x0000000000000000-mapping.dmp

Download
memory/1344-182-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1372-252-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/1372-246-0x0000000000000000-mapping.dmp

Download
memory/1372-248-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/1412-142-0x0000000000000000-mapping.dmp

Download
memory/1412-153-0x000002ABB7650000-0x000002ABB7672000-memory.dmp

Filesize
136KB

Download
memory/1412-155-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1412-173-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1488-216-0x0000000000000000-mapping.dmp

Download
memory/1528-140-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1528-139-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/1528-136-0x0000000000000000-mapping.dmp

Download
memory/1528-154-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/1608-214-0x0000000000000000-mapping.dmp

Download
memory/1780-221-0x0000000000000000-mapping.dmp

Download
memory/1828-235-0x0000000000000000-mapping.dmp

Download
memory/2116-223-0x0000000000000000-mapping.dmp

Download
memory/2164-195-0x0000000000000000-mapping.dmp

Download
memory/2296-132-0x0000000000000000-mapping.dmp

Download
memory/2464-237-0x0000000000000000-mapping.dmp

Download
memory/2680-207-0x0000000000000000-mapping.dmp

Download
memory/2788-209-0x0000000000000000-mapping.dmp

Download
memory/3080-185-0x0000000000000000-mapping.dmp

Download
memory/3488-202-0x0000000000000000-mapping.dmp

Download
memory/3620-183-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/3620-156-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/3620-143-0x0000000000000000-mapping.dmp

Download
memory/3828-234-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-238-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/3828-232-0x0000000000000000-mapping.dmp

Download
memory/3840-200-0x0000000000000000-mapping.dmp

Download
memory/3892-188-0x0000000000000000-mapping.dmp

Download
memory/4072-199-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4072-203-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4072-197-0x0000000000000000-mapping.dmp

Download
memory/4136-242-0x0000000000000000-mapping.dmp

Download
memory/4148-230-0x0000000000000000-mapping.dmp

Download
memory/4180-251-0x0000000000000000-mapping.dmp

Download
memory/4180-193-0x0000000000000000-mapping.dmp

Download
memory/4220-213-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4220-211-0x0000000000000000-mapping.dmp

Download
memory/4220-217-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4240-135-0x0000000000000000-mapping.dmp

Download
memory/4256-210-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-206-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-204-0x0000000000000000-mapping.dmp

Download
memory/4344-244-0x0000000000000000-mapping.dmp

Download
memory/4368-148-0x0000000000000000-mapping.dmp

Download
memory/4368-174-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/4368-161-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/4564-180-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/4564-147-0x0000000000000000-mapping.dmp

Download
memory/4564-162-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/4804-157-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/4804-171-0x00007FF970890000-0x00007FF971351000-memory.dmp

Filesize
10.8MB

Download
memory/4804-144-0x0000000000000000-mapping.dmp

Download
memory/4880-228-0x0000000000000000-mapping.dmp

Download
memory/4988-196-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/4988-249-0x0000000000000000-mapping.dmp

Download
memory/4988-190-0x0000000000000000-mapping.dmp

Download
memory/4988-192-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/5072-227-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/5072-231-0x00007FF9707E0000-0x00007FF9712A1000-memory.dmp

Filesize
10.8MB

Download
memory/5072-225-0x0000000000000000-mapping.dmp

Download