Analysis Overview
SHA256
490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d
Threat Level: Known bad
The file 490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
Dcrat family
DCRat payload
DcRat
DCRat payload
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Drops file in Windows directory
Drops file in Program Files directory
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies registry class
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-11-01 10:37
Signatures
DCRat payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Dcrat family
Analysis: behavioral1
Detonation Overview
Submitted
2022-11-01 10:37
Reported
2022-11-01 10:40
Platform
win10-20220812-en
Max time kernel
31s
Max time network
82s
Command Line
Signatures
DcRat
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe |
DCRat payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\providercommon\DllCommonsvc.exe | N/A |
| N/A | N/A | C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File opened for modification | C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Program Files\Windows Sidebar\Shared Gadgets\886983d96e3d3e | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ebf1f9fa8afd6d | C:\providercommon\DllCommonsvc.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\servicing\ja-JP\ShellExperienceHost.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Windows\Help\fr-FR\dwm.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Windows\Help\fr-FR\6cb0b6c459d5d3 | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Windows\debug\sihost.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Windows\debug\66fc9ff0ee96c2 | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\e6c9b481da804f | C:\providercommon\DllCommonsvc.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings | C:\providercommon\DllCommonsvc.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe
"C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\odt\wininit.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\fr-FR\dwm.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Help\fr-FR\dwm.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\fr-FR\dwm.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\odt\fontdrvhost.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\sihost.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\debug\sihost.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\sihost.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\wininit.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\fr-FR\dwm.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\sihost.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NbXwSAyXq.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| IE | 20.50.73.10:443 | tcp | |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 13.107.4.50:80 | tcp | |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
Files
memory/2576-115-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-116-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-117-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-118-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-120-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-121-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-123-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-124-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-125-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-126-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-127-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-128-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-130-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-131-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-132-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-133-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-129-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-134-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-136-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-135-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-137-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-138-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-139-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-140-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-141-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-142-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-143-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-144-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-145-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-146-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-148-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-147-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-149-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-150-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-151-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-152-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-153-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-154-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-155-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-156-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-157-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-158-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-159-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-160-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-161-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-162-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-163-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-164-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-166-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-165-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-167-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-168-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-169-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-170-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-171-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-172-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-173-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-174-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-175-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-176-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-177-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/2576-178-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/4784-179-0x0000000000000000-mapping.dmp
memory/4784-180-0x00000000775B0000-0x000000007773E000-memory.dmp
memory/4784-181-0x00000000775B0000-0x000000007773E000-memory.dmp
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
| MD5 | 8088241160261560a02c84025d107592 |
| SHA1 | 083121f7027557570994c9fc211df61730455bb5 |
| SHA256 | 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1 |
| SHA512 | 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478 |
C:\providercommon\1zu9dW.bat
| MD5 | 6783c3ee07c7d151ceac57f1f9c8bed7 |
| SHA1 | 17468f98f95bf504cc1f83c49e49a78526b3ea03 |
| SHA256 | 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322 |
| SHA512 | c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8 |
memory/3340-255-0x0000000000000000-mapping.dmp
memory/1356-278-0x0000000000000000-mapping.dmp
C:\providercommon\DllCommonsvc.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
C:\providercommon\DllCommonsvc.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/1356-281-0x0000000000ED0000-0x0000000000FE0000-memory.dmp
memory/1356-282-0x000000001BB20000-0x000000001BB32000-memory.dmp
memory/1356-283-0x000000001BB30000-0x000000001BB3C000-memory.dmp
memory/1356-284-0x000000001C150000-0x000000001C15C000-memory.dmp
memory/1356-285-0x000000001C160000-0x000000001C16C000-memory.dmp
memory/1404-286-0x0000000000000000-mapping.dmp
memory/360-289-0x0000000000000000-mapping.dmp
memory/1472-288-0x0000000000000000-mapping.dmp
memory/4352-291-0x0000000000000000-mapping.dmp
memory/2100-294-0x0000000000000000-mapping.dmp
memory/2332-293-0x0000000000000000-mapping.dmp
memory/3308-292-0x0000000000000000-mapping.dmp
memory/688-297-0x0000000000000000-mapping.dmp
memory/508-290-0x0000000000000000-mapping.dmp
memory/1320-287-0x0000000000000000-mapping.dmp
memory/4736-324-0x0000000000000000-mapping.dmp
memory/1404-337-0x0000023D6CFD0000-0x0000023D6CFF2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4NbXwSAyXq.bat
| MD5 | 425bc34a6861288302e84a733ec6f18b |
| SHA1 | e375cdfd4f952bba6d85465d824934e224e0dd5a |
| SHA256 | 174a5591c2356c746e64c8cc9ecc381dc7b55f80430b098bffcd5116705794a5 |
| SHA512 | 52a0180e4a814befa2dc3391a1ce84f604214b6340d768df875fecd18e539bcda80ec7abab6dcfc3b9344ed0efebd5e0e98c8535e7b8cae6fa555e557421a6b6 |
memory/4840-356-0x0000000000000000-mapping.dmp
memory/1320-360-0x0000027053F60000-0x0000027053FD6000-memory.dmp
memory/4660-587-0x0000000000000000-mapping.dmp
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/4660-604-0x0000000000EB0000-0x0000000000EC2000-memory.dmp
memory/4072-625-0x0000000000000000-mapping.dmp
memory/3584-627-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat
| MD5 | bcf905bd2264d23ed4f05a988c985fa5 |
| SHA1 | 4d6d35311b19dd82c3ffcc39bb9ee3399d6530dd |
| SHA256 | e5a5a0230eb758a8a9e1285a00bddcad5e039541c8f6abed290d2ca5b6faa3ab |
| SHA512 | e878cd7efe587313f2a80db58e11527b4ba017d5b2f88ecbe5481bc646dce9c95d152dad83c52e34bb1a57db199ec993bd69d8c74f43b91f263b8dc48ad35fc2 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | ad5cd538ca58cb28ede39c108acb5785 |
| SHA1 | 1ae910026f3dbe90ed025e9e96ead2b5399be877 |
| SHA256 | c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033 |
| SHA512 | c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 736d1356ca893b1b9a91a3a583bb993e |
| SHA1 | 33e11792346f27377b314361bf7c9607f573ad08 |
| SHA256 | 76ccf1504533d4340aea0a2674e6397108a57bbade578bca68018529a7f8d98e |
| SHA512 | bee294d6db0718566e6184627cf6d9f53289d72e7872121a940a52ccd9b8e7944c255cbafa21bbb076b0583ee1d1f02be2156b83d62bb0078ccf698995ffbee6 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 8f01ca0d95ea19e19929f3efaa52f6c1 |
| SHA1 | 9a73d20198ab36bec846182ef8e66fe6b351ed9e |
| SHA256 | f7e1d7f3d27bb3f51324c92bd7618cb4bc37d4f1f84f3dde838cddb3cb764519 |
| SHA512 | 961d0693a4ecf3c95d9555b553ef6722df7f54de0f0ac6159193f1e207051a0ab386a1c7e408e393b6b022a8e4ba32019c90b44a5190c0e2d578dc922bef6273 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 46c320488b813afd61c0e95b62f39434 |
| SHA1 | fffce41d82622db8efaac66b433915a6fb813b92 |
| SHA256 | cdfbc1a6deeec9bf1fda50ef3d1dd6716963b9e00421a1b613cc493f50aa3018 |
| SHA512 | 5fc54265ffd04019cb536943e69410feab8af919aa77d46c2c564f47ed4ee33345e87d13f300a52074f16f8bc668011abe580ecf582e41e87b233e23bc596590 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | fc0fc79be6552eeb5019dcdcb54d2e47 |
| SHA1 | 5175c9e3bd726ff9358fb22077b220163b5469fb |
| SHA256 | 43d69e20f5c01b01d16d18f0c7384e0fe98902e6a7010dfae9e6abf954f702f6 |
| SHA512 | 7141afbf67526875fb0bd8e55300da80977afa072d1e74feb3c3115bd33c8bcc7bc6d9b5aa53166ad647895e76d9ad085caf41dd0c75e01b980dda6cea126d6a |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | fc0fc79be6552eeb5019dcdcb54d2e47 |
| SHA1 | 5175c9e3bd726ff9358fb22077b220163b5469fb |
| SHA256 | 43d69e20f5c01b01d16d18f0c7384e0fe98902e6a7010dfae9e6abf954f702f6 |
| SHA512 | 7141afbf67526875fb0bd8e55300da80977afa072d1e74feb3c3115bd33c8bcc7bc6d9b5aa53166ad647895e76d9ad085caf41dd0c75e01b980dda6cea126d6a |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b5edd2b4210b3b789325c21d089f7203 |
| SHA1 | 5e6616a0c16f9d7844a7203f1dc16323f33c2302 |
| SHA256 | 59424b5a7db4f8f326d44e6b362d79a069119286244be26cd40d0d4e57d0edf8 |
| SHA512 | 1bf632b838cfe722f30f86be9558648c56331ea70e46be1a6c021ad2b6d53632efa7f93e74f0057d87e92d4905558e4a5da20b1559874bd0674ae7f1e4d4e7f9 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c2e75ae62d491e34cb4ce8a01fcf3c13 |
| SHA1 | 7921cfb6520a9b29b5884b0426a8e8272d037c4e |
| SHA256 | 36fc891bdb5e99f28a7547f2b6343cc70af433e886375a0255a29f37ccda25c7 |
| SHA512 | a91e04d7956b31ca2100c0b9491ff3ecaa5946800c7fc7a26944e1d23d992479855eaf4162d90c436dfac64a493f942085ae4fe4e491eb351c94b227ca4be675 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 34a2daea7c465cb8c993532892989928 |
| SHA1 | d51cb342644344c5102bcd7a03523c9077a6cc74 |
| SHA256 | 0a9756940e78577974604ccf4cff47f4d6ed50d1bb21b3ab5a8220011dc48a35 |
| SHA512 | ec6610287cb02d218f88d21bacd9f1b820c6ee5fd19043bc76b874e5c0ff3977d6cb070c447eabe0995df0408c83690d4fde8ef76002100db54dd87c73e8cf1f |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 34a2daea7c465cb8c993532892989928 |
| SHA1 | d51cb342644344c5102bcd7a03523c9077a6cc74 |
| SHA256 | 0a9756940e78577974604ccf4cff47f4d6ed50d1bb21b3ab5a8220011dc48a35 |
| SHA512 | ec6610287cb02d218f88d21bacd9f1b820c6ee5fd19043bc76b874e5c0ff3977d6cb070c447eabe0995df0408c83690d4fde8ef76002100db54dd87c73e8cf1f |
memory/3200-648-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
| MD5 | d63ff49d7c92016feb39812e4db10419 |
| SHA1 | 2307d5e35ca9864ffefc93acf8573ea995ba189b |
| SHA256 | 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12 |
| SHA512 | 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a |
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/4904-651-0x0000000000000000-mapping.dmp
memory/5084-653-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat
| MD5 | 43a1a9e1fe92857152921c1ba5d805f9 |
| SHA1 | b3537d069f17ee3682cad93a34cc24ed39838445 |
| SHA256 | bbe56d5b9d8cf255aab2fbda4716a01bce9caa70ca97dc2eb304e6edea5caa00 |
| SHA512 | d4e667a693093d47e6292148ad7027f668e92946280ec72c2a1ccfaf817c0f717a7dffb861241208983376a3079d5df16df0313db755bd5243dbbca3f08604ef |
memory/5076-654-0x0000000000000000-mapping.dmp
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/4436-656-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat
| MD5 | 3918e04cdaa684046241e355ff45cf3d |
| SHA1 | f7a0d54901a433ba905aed51d82f4990c848a439 |
| SHA256 | 93dad48f06b0499a9ac6a76fec73b07a3809a27a6a3e436dc5230a5dfd18368f |
| SHA512 | f93ce9771e776c932943035383bd35f45055c9637abc8c22479bdd7edffd8f5304a0b36c5a4ddc211f4ac5caea490efe227c429e9461b16d28f562975a25c0f8 |
memory/364-658-0x0000000000000000-mapping.dmp
memory/1700-659-0x0000000000000000-mapping.dmp
C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/2444-661-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat
| MD5 | 764324d74a2730d3664d3547263a6aa0 |
| SHA1 | a4ff10af10d0fd3122733be48a2cb6d1520b7540 |
| SHA256 | 083dcfe4a606d2d8c5990ef93ee7bf37b146b46d9bced12c888d5db39a47f75c |
| SHA512 | c5b893f7598d205455006c86f423e6b0a3c860cfa4c713b8a2d904c12682f0030a8ac7dc37048e67352a831fab747128405c8b91d6456d104051bfc7d65e0873 |
memory/4080-663-0x0000000000000000-mapping.dmp