dcrat | eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01-11-2022 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe
Size

1.3MB
MD5

5ac329ecbe6f960be3ffd836a9e28f6d
SHA1

c71c92ca2e634298fc1106ec7662d9e594aef100
SHA256

eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44
SHA512

363b7726c3373dee058abb8bcf58219323f1644c42da218c2721044d443f6e378a2c8e8300580b0b7b110adbee57100b5d46d3e2f1dc17764d4e945adf0c9e30
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	4448	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4448	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000600000001ac25-279.dat	dcrat
behavioral1/files/0x000600000001ac25-280.dat	dcrat
behavioral1/memory/4284-281-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac35-537.dat	dcrat
behavioral1/files/0x000700000001ac35-538.dat	dcrat
behavioral1/files/0x000700000001ac35-544.dat	dcrat
behavioral1/files/0x000700000001ac35-550.dat	dcrat
behavioral1/files/0x000700000001ac35-556.dat	dcrat
behavioral1/files/0x000700000001ac35-562.dat	dcrat
behavioral1/files/0x000700000001ac35-567.dat	dcrat
behavioral1/files/0x000700000001ac35-572.dat	dcrat
behavioral1/files/0x000700000001ac35-578.dat	dcrat
behavioral1/files/0x000700000001ac35-583.dat	dcrat
behavioral1/files/0x000700000001ac35-589.dat	dcrat
behavioral1/files/0x000700000001ac35-595.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
4284	DllCommonsvc.exe
3900	DllCommonsvc.exe
2396	DllCommonsvc.exe
3600	DllCommonsvc.exe
1880	DllCommonsvc.exe
4328	DllCommonsvc.exe
3776	DllCommonsvc.exe
3244	DllCommonsvc.exe
3288	DllCommonsvc.exe
2928	DllCommonsvc.exe
900	DllCommonsvc.exe
2880	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\a76d7bf15d8370	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\authman\System.exe	DllCommonsvc.exe
File created	C:\Windows\Microsoft.NET\authman\27d1bcfc3c54e0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5076	schtasks.exe
5060	schtasks.exe
3156	schtasks.exe
4320	schtasks.exe
1880	schtasks.exe
4980	schtasks.exe
4596	schtasks.exe
3648	schtasks.exe
4972	schtasks.exe
4408	schtasks.exe
4324	schtasks.exe
4660	schtasks.exe
4500	schtasks.exe
4316	schtasks.exe
4344	schtasks.exe
4296	schtasks.exe
4564	schtasks.exe
4532	schtasks.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4284	DllCommonsvc.exe
4476	powershell.exe
3164	powershell.exe
4480	powershell.exe
3200	powershell.exe
388	powershell.exe
4480	powershell.exe
1356	powershell.exe
4600	powershell.exe
3164	powershell.exe
1356	powershell.exe
388	powershell.exe
4480	powershell.exe
4476	powershell.exe
4600	powershell.exe
3200	powershell.exe
3164	powershell.exe
1356	powershell.exe
388	powershell.exe
4476	powershell.exe
4600	powershell.exe
3200	powershell.exe
3900	DllCommonsvc.exe
2396	DllCommonsvc.exe
3600	DllCommonsvc.exe
1880	DllCommonsvc.exe
4328	DllCommonsvc.exe
3776	DllCommonsvc.exe
3244	DllCommonsvc.exe
3288	DllCommonsvc.exe
2928	DllCommonsvc.exe
900	DllCommonsvc.exe
2880	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	DllCommonsvc.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe
Token: 36	4480	powershell.exe
Token: SeIncreaseQuotaPrivilege	3164	powershell.exe
Token: SeSecurityPrivilege	3164	powershell.exe
Token: SeTakeOwnershipPrivilege	3164	powershell.exe
Token: SeLoadDriverPrivilege	3164	powershell.exe
Token: SeSystemProfilePrivilege	3164	powershell.exe
Token: SeSystemtimePrivilege	3164	powershell.exe
Token: SeProfSingleProcessPrivilege	3164	powershell.exe
Token: SeIncBasePriorityPrivilege	3164	powershell.exe
Token: SeCreatePagefilePrivilege	3164	powershell.exe
Token: SeBackupPrivilege	3164	powershell.exe
Token: SeRestorePrivilege	3164	powershell.exe
Token: SeShutdownPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeSystemEnvironmentPrivilege	3164	powershell.exe
Token: SeRemoteShutdownPrivilege	3164	powershell.exe
Token: SeUndockPrivilege	3164	powershell.exe
Token: SeManageVolumePrivilege	3164	powershell.exe
Token: 33	3164	powershell.exe
Token: 34	3164	powershell.exe
Token: 35	3164	powershell.exe
Token: 36	3164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1356	powershell.exe
Token: SeSecurityPrivilege	1356	powershell.exe
Token: SeTakeOwnershipPrivilege	1356	powershell.exe
Token: SeLoadDriverPrivilege	1356	powershell.exe
Token: SeSystemProfilePrivilege	1356	powershell.exe
Token: SeSystemtimePrivilege	1356	powershell.exe
Token: SeProfSingleProcessPrivilege	1356	powershell.exe
Token: SeIncBasePriorityPrivilege	1356	powershell.exe
Token: SeCreatePagefilePrivilege	1356	powershell.exe
Token: SeBackupPrivilege	1356	powershell.exe
Token: SeRestorePrivilege	1356	powershell.exe
Token: SeShutdownPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeSystemEnvironmentPrivilege	1356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1680	2832	eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe	66
PID 2832 wrote to memory of 1680	2832	eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe	66
PID 2832 wrote to memory of 1680	2832	eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe	66
PID 1680 wrote to memory of 4216	1680	WScript.exe	67
PID 1680 wrote to memory of 4216	1680	WScript.exe	67
PID 1680 wrote to memory of 4216	1680	WScript.exe	67
PID 4216 wrote to memory of 4284	4216	cmd.exe	69
PID 4216 wrote to memory of 4284	4216	cmd.exe	69
PID 4284 wrote to memory of 4476	4284	DllCommonsvc.exe	89
PID 4284 wrote to memory of 4476	4284	DllCommonsvc.exe	89
PID 4284 wrote to memory of 4480	4284	DllCommonsvc.exe	90
PID 4284 wrote to memory of 4480	4284	DllCommonsvc.exe	90
PID 4284 wrote to memory of 3164	4284	DllCommonsvc.exe	99
PID 4284 wrote to memory of 3164	4284	DllCommonsvc.exe	99
PID 4284 wrote to memory of 4600	4284	DllCommonsvc.exe	91
PID 4284 wrote to memory of 4600	4284	DllCommonsvc.exe	91
PID 4284 wrote to memory of 3200	4284	DllCommonsvc.exe	96
PID 4284 wrote to memory of 3200	4284	DllCommonsvc.exe	96
PID 4284 wrote to memory of 388	4284	DllCommonsvc.exe	92
PID 4284 wrote to memory of 388	4284	DllCommonsvc.exe	92
PID 4284 wrote to memory of 1356	4284	DllCommonsvc.exe	93
PID 4284 wrote to memory of 1356	4284	DllCommonsvc.exe	93
PID 4284 wrote to memory of 644	4284	DllCommonsvc.exe	103
PID 4284 wrote to memory of 644	4284	DllCommonsvc.exe	103
PID 644 wrote to memory of 4272	644	cmd.exe	105
PID 644 wrote to memory of 4272	644	cmd.exe	105
PID 644 wrote to memory of 3900	644	cmd.exe	107
PID 644 wrote to memory of 3900	644	cmd.exe	107
PID 3900 wrote to memory of 3344	3900	DllCommonsvc.exe	108
PID 3900 wrote to memory of 3344	3900	DllCommonsvc.exe	108
PID 3344 wrote to memory of 2300	3344	cmd.exe	110
PID 3344 wrote to memory of 2300	3344	cmd.exe	110
PID 3344 wrote to memory of 2396	3344	cmd.exe	111
PID 3344 wrote to memory of 2396	3344	cmd.exe	111
PID 2396 wrote to memory of 1920	2396	DllCommonsvc.exe	112
PID 2396 wrote to memory of 1920	2396	DllCommonsvc.exe	112
PID 1920 wrote to memory of 4236	1920	cmd.exe	114
PID 1920 wrote to memory of 4236	1920	cmd.exe	114
PID 1920 wrote to memory of 3600	1920	cmd.exe	115
PID 1920 wrote to memory of 3600	1920	cmd.exe	115
PID 3600 wrote to memory of 2648	3600	DllCommonsvc.exe	116
PID 3600 wrote to memory of 2648	3600	DllCommonsvc.exe	116
PID 2648 wrote to memory of 4520	2648	cmd.exe	118
PID 2648 wrote to memory of 4520	2648	cmd.exe	118
PID 2648 wrote to memory of 1880	2648	cmd.exe	119
PID 2648 wrote to memory of 1880	2648	cmd.exe	119
PID 1880 wrote to memory of 3324	1880	DllCommonsvc.exe	120
PID 1880 wrote to memory of 3324	1880	DllCommonsvc.exe	120
PID 3324 wrote to memory of 224	3324	cmd.exe	122
PID 3324 wrote to memory of 224	3324	cmd.exe	122
PID 3324 wrote to memory of 4328	3324	cmd.exe	123
PID 3324 wrote to memory of 4328	3324	cmd.exe	123
PID 4328 wrote to memory of 2184	4328	DllCommonsvc.exe	124
PID 4328 wrote to memory of 2184	4328	DllCommonsvc.exe	124
PID 2184 wrote to memory of 732	2184	cmd.exe	126
PID 2184 wrote to memory of 732	2184	cmd.exe	126
PID 2184 wrote to memory of 3776	2184	cmd.exe	127
PID 2184 wrote to memory of 3776	2184	cmd.exe	127
PID 3776 wrote to memory of 4548	3776	DllCommonsvc.exe	128
PID 3776 wrote to memory of 4548	3776	DllCommonsvc.exe	128
PID 4548 wrote to memory of 364	4548	cmd.exe	130
PID 4548 wrote to memory of 364	4548	cmd.exe	130
PID 4548 wrote to memory of 3244	4548	cmd.exe	131
PID 4548 wrote to memory of 3244	4548	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe
"C:\Users\Admin\AppData\Local\Temp\eac9693c72384b6ec29c6071ebef614361af9cc0e0c921c32a892d82f58e3f44.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\authman\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Templates\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVDHtinNry.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:644
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4272
      - C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2300
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4236
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4520
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mMyBvdYgq2.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:224
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:732
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:364
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        19⤵
        
        PID:2436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3692
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat"
        21⤵
        
        PID:2868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2188
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzJh52oHEl.bat"
        23⤵
        
        PID:1500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1396
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat"
        25⤵
        
        PID:2092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4208
        
        C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat"
        27⤵
        
        PID:3316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\authman\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\authman\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Media Player\it-IT\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
17be2562b54184a03dd158511357f1cb

SHA1
080b8acd3d2c32a3ad5bf9f027d3ac87872b7cc7

SHA256
b24e7386eeab47f4345ae0aee6480b0d400486014891e37ce3c0c4234dfec1c0

SHA512
553fae289123b9fffa8222e5181842bb3f592b5e05a770f1d3ebdc39d0c20ce775f70654038d849bedc9f8004e7d741d416596b020e0affb971c2a895da65d97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c138b6d7a33869c830cac9cdf7f4d160

SHA1
3c9fa7909b37ad914f4b0d45f321ef0c9380e232

SHA256
293e839f8d3fc0a00e164d64f058252c4bf92efb0da9c674923ecdbbf65eb4bb

SHA512
b9d90e22a1732058df57e5a1335284ee7d25270057f213f2e5e2ad3952dcabbd9ac7da9ea90484d8fe9e3fd79437f7cc7025d50edcf19e6c9de078cc8de8b2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad10d51b057b9650b9a9b82615cf4822

SHA1
cb11fbc011fdeed74bf7638727dc99a7a232095f

SHA256
103b64c6fe60594dfec810ccae110bb266d4d303085b4fe8471e53344475c6f1

SHA512
ff2b7cea3db059209b06ab4b0b6f8b17d75c3cebfa0551668f34cd4748b27b8dff541ba27621c1d488bbe201b8ad7bb676762319eeefa71c99cff786baeee6d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6daefb7f532060e0ed0b619ded59677e

SHA1
bcfa6aa151c4dfddcd2d9c8707ad1ed5ff415dd8

SHA256
586255b50db4eb17e389910b6b8f253f8350b5f9910f1dccf8398a847643f9e6

SHA512
b12e0d0afb59f0b2fa8f820ca2836b3bc35270ef2b3777295c62da2b2bdb28d268a84d9d4975147100dc2f8f63d409706bd9ed3f45747eb87d14f3c924a4f729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2a0306eb9cd77f5d925f2c4e75df7609

SHA1
cb00b7d9a44117379a478993c29fc623c67bb333

SHA256
9f2caf9a26f0343e3790aa3915a555c23f3a97bf3dec12e48bef66ad4c2d1a79

SHA512
0ed11da75ddba107200dff3a2c53cb7ad9357fd737a718730c2fc3357428cedc04ce631aa1e75ab314811580c0a5c0e0f1edf8b63d281e66631491ea43e7bdf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2a0306eb9cd77f5d925f2c4e75df7609

SHA1
cb00b7d9a44117379a478993c29fc623c67bb333

SHA256
9f2caf9a26f0343e3790aa3915a555c23f3a97bf3dec12e48bef66ad4c2d1a79

SHA512
0ed11da75ddba107200dff3a2c53cb7ad9357fd737a718730c2fc3357428cedc04ce631aa1e75ab314811580c0a5c0e0f1edf8b63d281e66631491ea43e7bdf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat

Filesize
231B

MD5
3cfe084f3d00233a052627af5c21fd0a

SHA1
61f2f26e00972ac430d64efe12f89021d3224d18

SHA256
8c4abbe7ab8720acbfab43f6aa3603f1e876f5188ad8178900d6c402fe4be63f

SHA512
c4bc04a774b46efe8f62e699277da766abf4d60512c0e55829192f1ff5e9abecab1916962510dc511efee28655f8cf8b8d8d7eeb00601a86d49dd2240f5803e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat

Filesize
231B

MD5
3cfe084f3d00233a052627af5c21fd0a

SHA1
61f2f26e00972ac430d64efe12f89021d3224d18

SHA256
8c4abbe7ab8720acbfab43f6aa3603f1e876f5188ad8178900d6c402fe4be63f

SHA512
c4bc04a774b46efe8f62e699277da766abf4d60512c0e55829192f1ff5e9abecab1916962510dc511efee28655f8cf8b8d8d7eeb00601a86d49dd2240f5803e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat

Filesize
231B

MD5
50a48d86a292fef8931a4d2cfc92b98c

SHA1
097afd7409e935c05d4c5a055847bb8db8fbcbb9

SHA256
ae80c0b7ce9e6aacdc4948ae9dc313e7657c27ebbcae4813737e50bebaa3caf4

SHA512
efc935daf2e8a6d6ed43f65357d85020ab4916b4d1c32ae194033986ec3662311b369f02c363bc4770aeeb466015f0e665ea67c42e7f09974b5099ff200b8660

Download Submit
C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat

Filesize
231B

MD5
50a48d86a292fef8931a4d2cfc92b98c

SHA1
097afd7409e935c05d4c5a055847bb8db8fbcbb9

SHA256
ae80c0b7ce9e6aacdc4948ae9dc313e7657c27ebbcae4813737e50bebaa3caf4

SHA512
efc935daf2e8a6d6ed43f65357d85020ab4916b4d1c32ae194033986ec3662311b369f02c363bc4770aeeb466015f0e665ea67c42e7f09974b5099ff200b8660

Download Submit
C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat

Filesize
231B

MD5
bda190ff0cbe7b86e60d0a23e4839dab

SHA1
1e0d8d3eb726b76f927ef599908e833e44aba338

SHA256
584887d6fff74af86f1e8de15005ed0f12eef4de7a5f406e9fda8ce047d0c690

SHA512
291c90daa82c3e050eadd185a32c7536b485911f04fd7bbcb43f012cc9de6002f8cbb04a293eca2b32075e1f384f8f1f4120a57d5b5f4ed48342bf7c94319ef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\EzJh52oHEl.bat

Filesize
231B

MD5
71ef0d86d7a8558d0cbfdddb4887058d

SHA1
1a76a5a3d6f92b6ed6af6ebd2b22ff0443b0fd89

SHA256
76ba52346df8351dd84779fd348bc12ee076fe6cc674d360c526631d3371d9fa

SHA512
a1709bc4b2b91c03be038a207707953ef4061061a1aa7ab6d333ea65e2423034fe5fdbe94acc48332c0179e7ae6b393eafb44a7aa30ee5c0169658039a42f570

Download Submit
C:\Users\Admin\AppData\Local\Temp\OVDHtinNry.bat

Filesize
231B

MD5
d621014e079a239fcab0b4cece37b1f7

SHA1
d3e0cc3161e47c91552497daee635e2c84ec7fa5

SHA256
5c2169d6f1a6083e8da9d262df7544d550d27181b0e362080c69e6e467a8ab2b

SHA512
9387c73f90c4bf3e1429e6317ec9d92be7df3b3c7c1f149d665652ed6b7a4196ea0a2ac88386678dedef9c815434fb1f3a560bd6d652d3d067eb382bb34234b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat

Filesize
231B

MD5
06cde8f8846dded9536931973eaf0f45

SHA1
587f31681ea71fffbeb36d06a1254f1d0fbdad66

SHA256
226a679354412a0509ee89568ba467208bfe4745a98c72802f5d474db3308a65

SHA512
8801c9c7f121e34f5636c54ee2ec83528779dc71f069edd4c1b4b31a91b019457dae8bff0e9125c22902ec08fb945f6c72a14353df16e066429ddfbcfdbfde2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
231B

MD5
c826e88feca1b361a8a8801368fa52f8

SHA1
fef047423064b48e7879ae4ab4b4dd6d1675aeae

SHA256
067e7c4d4329badcf5e9ae7c660c41aab565c8f7226a5960f2ee8fa6c5685384

SHA512
ea8eed809c1e0db75ebff622cfe7f09315284d1dc19ea1b28c6014dd79af03916bc212afebaca38bbd32d6cea3a0fe08b4a82c342408e5ac5a224591c3928275

Download Submit
C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat

Filesize
231B

MD5
d5a0e15d69abcfa6b9c6e92e727a1f19

SHA1
89ea5ef3859278c32de54bf59f22eab42b1fc5d9

SHA256
fc371a6403c8c9542d9bfb0c9da102f57456df813e47beeb6f55fb2ce38ff1ed

SHA512
b132bf64ea0acecc4d3984abd32ab6348e56291dc24e288a96cd7243478125f35fa8caadd3f2e5d84a851bf56f0beb5653d2628b39268f1158c6ff64f0b05433

Download Submit
C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

Filesize
231B

MD5
8d281c2ebc3c98a136a43d27e7d7ced7

SHA1
047fc06c9f2e0a9a34f49ff15015cb4c98bc63b6

SHA256
ffc566368ad8f33315301b5689a3cb931212e1671abb3a7eb1db6ba8349db9e2

SHA512
d1fafb7e49dfc0754d95956d297511e23953907bc144c60d853adb079c3def3b08c6ef1a2f65d59426005141124f5586583ad8af5dbb45ca2e93756a6b788df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mMyBvdYgq2.bat

Filesize
231B

MD5
0f3c219d68dc1f1254704f537012000d

SHA1
2688ed477ed28d40809413d5f38b23c161f504ef

SHA256
bf3da7cb9695ad0b4b356d8ca8d4b2d55ba30794095108ab3915131b7312459e

SHA512
f62dd58923d03f8018ca72cf9c87eb8182e29b9dea07f7e95a0cb811c075f8b085ea93b0405275c619372abfbf6f12aaba47a7b83e993931ca32599d0d20b622

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/900-590-0x0000000000970000-0x0000000000982000-memory.dmp

Filesize
72KB

Download
memory/1680-180-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/1680-181-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/1880-557-0x0000000001240000-0x0000000001252000-memory.dmp

Filesize
72KB

Download
memory/2396-545-0x00000000030C0000-0x00000000030D2000-memory.dmp

Filesize
72KB

Download
memory/2832-156-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-158-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-177-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-176-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-175-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-174-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-173-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-131-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-116-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-172-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-171-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-132-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-133-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-117-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-134-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-118-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-120-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-121-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-135-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-123-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-170-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-136-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-169-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-168-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-124-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-125-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-167-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-126-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-165-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-166-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-164-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-163-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-162-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-161-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-160-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-127-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-159-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-138-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-157-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-130-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-115-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-155-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-154-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-153-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-152-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-150-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-151-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-137-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-178-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-149-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-128-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-148-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-147-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-139-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-146-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-145-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-144-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-140-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-143-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-142-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-129-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2832-141-0x00000000771B0000-0x000000007733E000-memory.dmp

Filesize
1.6MB

Download
memory/2880-596-0x0000000000760000-0x0000000000772000-memory.dmp

Filesize
72KB

Download
memory/2928-584-0x0000000002E90000-0x0000000002EA2000-memory.dmp

Filesize
72KB

Download
memory/3244-573-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3600-551-0x0000000001930000-0x0000000001942000-memory.dmp

Filesize
72KB

Download
memory/4284-284-0x0000000000950000-0x000000000095C000-memory.dmp

Filesize
48KB

Download
memory/4284-281-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/4284-282-0x0000000000930000-0x0000000000942000-memory.dmp

Filesize
72KB

Download
memory/4284-283-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/4284-285-0x0000000000960000-0x000000000096C000-memory.dmp

Filesize
48KB

Download
memory/4476-322-0x0000026243200000-0x0000026243222000-memory.dmp

Filesize
136KB

Download
memory/4480-327-0x0000015CE48A0000-0x0000015CE4916000-memory.dmp

Filesize
472KB

Download