dcrat | c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800

Analysis

max time kernel
147s
max time network
144s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02/11/2022, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe
Size

1.3MB
MD5

cd4c52e74126519b1000925da79b33ea
SHA1

33bdda2679ef83acb055a2bafb57100c98b89ef4
SHA256

c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800
SHA512

9d1e2e4b68db3fac2f8a2ef33be293304c2f660ca9478fcf71f9d66aa561036c9fe09b1226570066444e9e1c4c62c60396325b38ae849dcba19b2e08ae3008d4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3172	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3172	schtasks.exe	70

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac2d-280.dat	dcrat
behavioral1/files/0x000800000001ac2d-281.dat	dcrat
behavioral1/memory/4820-282-0x0000000000D20000-0x0000000000E30000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac36-439.dat	dcrat
behavioral1/files/0x000600000001ac36-440.dat	dcrat
behavioral1/files/0x000600000001ac36-445.dat	dcrat
behavioral1/files/0x000600000001ac36-452.dat	dcrat
behavioral1/files/0x000600000001ac36-457.dat	dcrat
behavioral1/files/0x000600000001ac36-462.dat	dcrat
behavioral1/files/0x000600000001ac36-467.dat	dcrat
behavioral1/files/0x000600000001ac36-473.dat	dcrat
behavioral1/files/0x000600000001ac36-478.dat	dcrat
behavioral1/files/0x000600000001ac36-484.dat	dcrat
behavioral1/files/0x000600000001ac36-490.dat	dcrat
behavioral1/files/0x000600000001ac36-495.dat	dcrat
behavioral1/files/0x000600000001ac36-501.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
4820	DllCommonsvc.exe
3016	services.exe
3488	services.exe
4292	services.exe
5060	services.exe
2272	services.exe
2672	services.exe
4444	services.exe
3284	services.exe
3572	services.exe
4812	services.exe
3164	services.exe
4248	services.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\en-US\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\en-US\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4492	schtasks.exe
5016	schtasks.exe
5060	schtasks.exe
4356	schtasks.exe
4624	schtasks.exe
2888	schtasks.exe
5052	schtasks.exe
4952	schtasks.exe
4920	schtasks.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	services.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4820	DllCommonsvc.exe
4820	DllCommonsvc.exe
4820	DllCommonsvc.exe
3236	powershell.exe
4340	powershell.exe
3032	powershell.exe
4340	powershell.exe
3236	powershell.exe
4344	powershell.exe
4344	powershell.exe
4340	powershell.exe
3236	powershell.exe
3032	powershell.exe
4344	powershell.exe
3032	powershell.exe
3016	services.exe
3488	services.exe
4292	services.exe
5060	services.exe
2272	services.exe
2672	services.exe
4444	services.exe
3284	services.exe
3572	services.exe
4812	services.exe
3164	services.exe
4248	services.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	DllCommonsvc.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4340	powershell.exe
Token: SeSecurityPrivilege	4340	powershell.exe
Token: SeTakeOwnershipPrivilege	4340	powershell.exe
Token: SeLoadDriverPrivilege	4340	powershell.exe
Token: SeSystemProfilePrivilege	4340	powershell.exe
Token: SeSystemtimePrivilege	4340	powershell.exe
Token: SeProfSingleProcessPrivilege	4340	powershell.exe
Token: SeIncBasePriorityPrivilege	4340	powershell.exe
Token: SeCreatePagefilePrivilege	4340	powershell.exe
Token: SeBackupPrivilege	4340	powershell.exe
Token: SeRestorePrivilege	4340	powershell.exe
Token: SeShutdownPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeSystemEnvironmentPrivilege	4340	powershell.exe
Token: SeRemoteShutdownPrivilege	4340	powershell.exe
Token: SeUndockPrivilege	4340	powershell.exe
Token: SeManageVolumePrivilege	4340	powershell.exe
Token: 33	4340	powershell.exe
Token: 34	4340	powershell.exe
Token: 35	4340	powershell.exe
Token: 36	4340	powershell.exe
Token: SeIncreaseQuotaPrivilege	3236	powershell.exe
Token: SeSecurityPrivilege	3236	powershell.exe
Token: SeTakeOwnershipPrivilege	3236	powershell.exe
Token: SeLoadDriverPrivilege	3236	powershell.exe
Token: SeSystemProfilePrivilege	3236	powershell.exe
Token: SeSystemtimePrivilege	3236	powershell.exe
Token: SeProfSingleProcessPrivilege	3236	powershell.exe
Token: SeIncBasePriorityPrivilege	3236	powershell.exe
Token: SeCreatePagefilePrivilege	3236	powershell.exe
Token: SeBackupPrivilege	3236	powershell.exe
Token: SeRestorePrivilege	3236	powershell.exe
Token: SeShutdownPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeSystemEnvironmentPrivilege	3236	powershell.exe
Token: SeRemoteShutdownPrivilege	3236	powershell.exe
Token: SeUndockPrivilege	3236	powershell.exe
Token: SeManageVolumePrivilege	3236	powershell.exe
Token: 33	3236	powershell.exe
Token: 34	3236	powershell.exe
Token: 35	3236	powershell.exe
Token: 36	3236	powershell.exe
Token: SeIncreaseQuotaPrivilege	4344	powershell.exe
Token: SeSecurityPrivilege	4344	powershell.exe
Token: SeTakeOwnershipPrivilege	4344	powershell.exe
Token: SeLoadDriverPrivilege	4344	powershell.exe
Token: SeSystemProfilePrivilege	4344	powershell.exe
Token: SeSystemtimePrivilege	4344	powershell.exe
Token: SeProfSingleProcessPrivilege	4344	powershell.exe
Token: SeIncBasePriorityPrivilege	4344	powershell.exe
Token: SeCreatePagefilePrivilege	4344	powershell.exe
Token: SeBackupPrivilege	4344	powershell.exe
Token: SeRestorePrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeSystemEnvironmentPrivilege	4344	powershell.exe
Token: SeRemoteShutdownPrivilege	4344	powershell.exe
Token: SeUndockPrivilege	4344	powershell.exe
Token: SeManageVolumePrivilege	4344	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 5072	2772	c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe	66
PID 2772 wrote to memory of 5072	2772	c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe	66
PID 2772 wrote to memory of 5072	2772	c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe	66
PID 5072 wrote to memory of 4260	5072	WScript.exe	67
PID 5072 wrote to memory of 4260	5072	WScript.exe	67
PID 5072 wrote to memory of 4260	5072	WScript.exe	67
PID 4260 wrote to memory of 4820	4260	cmd.exe	69
PID 4260 wrote to memory of 4820	4260	cmd.exe	69
PID 4820 wrote to memory of 3032	4820	DllCommonsvc.exe	80
PID 4820 wrote to memory of 3032	4820	DllCommonsvc.exe	80
PID 4820 wrote to memory of 3236	4820	DllCommonsvc.exe	82
PID 4820 wrote to memory of 3236	4820	DllCommonsvc.exe	82
PID 4820 wrote to memory of 4340	4820	DllCommonsvc.exe	87
PID 4820 wrote to memory of 4340	4820	DllCommonsvc.exe	87
PID 4820 wrote to memory of 4344	4820	DllCommonsvc.exe	86
PID 4820 wrote to memory of 4344	4820	DllCommonsvc.exe	86
PID 4820 wrote to memory of 420	4820	DllCommonsvc.exe	88
PID 4820 wrote to memory of 420	4820	DllCommonsvc.exe	88
PID 420 wrote to memory of 1856	420	cmd.exe	90
PID 420 wrote to memory of 1856	420	cmd.exe	90
PID 420 wrote to memory of 3016	420	cmd.exe	92
PID 420 wrote to memory of 3016	420	cmd.exe	92
PID 3016 wrote to memory of 4900	3016	services.exe	93
PID 3016 wrote to memory of 4900	3016	services.exe	93
PID 4900 wrote to memory of 5076	4900	cmd.exe	95
PID 4900 wrote to memory of 5076	4900	cmd.exe	95
PID 4900 wrote to memory of 3488	4900	cmd.exe	96
PID 4900 wrote to memory of 3488	4900	cmd.exe	96
PID 3488 wrote to memory of 4088	3488	services.exe	97
PID 3488 wrote to memory of 4088	3488	services.exe	97
PID 4088 wrote to memory of 4908	4088	cmd.exe	99
PID 4088 wrote to memory of 4908	4088	cmd.exe	99
PID 4088 wrote to memory of 4292	4088	cmd.exe	100
PID 4088 wrote to memory of 4292	4088	cmd.exe	100
PID 4292 wrote to memory of 5056	4292	services.exe	101
PID 4292 wrote to memory of 5056	4292	services.exe	101
PID 5056 wrote to memory of 2884	5056	cmd.exe	103
PID 5056 wrote to memory of 2884	5056	cmd.exe	103
PID 5056 wrote to memory of 5060	5056	cmd.exe	104
PID 5056 wrote to memory of 5060	5056	cmd.exe	104
PID 5060 wrote to memory of 2248	5060	services.exe	105
PID 5060 wrote to memory of 2248	5060	services.exe	105
PID 2248 wrote to memory of 200	2248	cmd.exe	107
PID 2248 wrote to memory of 200	2248	cmd.exe	107
PID 2248 wrote to memory of 2272	2248	cmd.exe	108
PID 2248 wrote to memory of 2272	2248	cmd.exe	108
PID 2272 wrote to memory of 4928	2272	services.exe	109
PID 2272 wrote to memory of 4928	2272	services.exe	109
PID 4928 wrote to memory of 2244	4928	cmd.exe	111
PID 4928 wrote to memory of 2244	4928	cmd.exe	111
PID 4928 wrote to memory of 2672	4928	cmd.exe	112
PID 4928 wrote to memory of 2672	4928	cmd.exe	112
PID 2672 wrote to memory of 3052	2672	services.exe	113
PID 2672 wrote to memory of 3052	2672	services.exe	113
PID 3052 wrote to memory of 4744	3052	cmd.exe	115
PID 3052 wrote to memory of 4744	3052	cmd.exe	115
PID 3052 wrote to memory of 4444	3052	cmd.exe	116
PID 3052 wrote to memory of 4444	3052	cmd.exe	116
PID 4444 wrote to memory of 876	4444	services.exe	117
PID 4444 wrote to memory of 876	4444	services.exe	117
PID 876 wrote to memory of 3844	876	cmd.exe	119
PID 876 wrote to memory of 3844	876	cmd.exe	119
PID 876 wrote to memory of 3284	876	cmd.exe	120
PID 876 wrote to memory of 3284	876	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe
"C:\Users\Admin\AppData\Local\Temp\c11a27a9612ed303b40e92c78dd4f6de59144484dc50a4646df2f8a1b2d0e800.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\en-US\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RUJOSyqox9.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:420
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1856
      - C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:5076
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4908
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Or3SRhMf8V.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2884
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:200
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2244
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4744
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVa8TbDE3p.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3844
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat"
        21⤵
        
        PID:1640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1252
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"
        23⤵
        
        PID:4552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2944
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat"
        25⤵
        
        PID:2676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4076
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Yvohz7Nokj.bat"
        27⤵
        
        PID:3016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3584
        
        C:\providercommon\services.exe
        
        "C:\providercommon\services.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Default\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bde87cc16c287153b0dd1fc61944cfa2

SHA1
be9e44f42a213fbe306b321687da16032cce42d3

SHA256
3763fe5234d81009837bdcaefbe86c7f906fadebabe1411a2e9693c3ac5adc8b

SHA512
f281b02eb34fb70e425b82a91f992d62d211f66c099f9cc9f254bf7ed9853c4868521269f753b0c9d603507d683abadf409d4dd827d3b7d054708c7c75cfa8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bde87cc16c287153b0dd1fc61944cfa2

SHA1
be9e44f42a213fbe306b321687da16032cce42d3

SHA256
3763fe5234d81009837bdcaefbe86c7f906fadebabe1411a2e9693c3ac5adc8b

SHA512
f281b02eb34fb70e425b82a91f992d62d211f66c099f9cc9f254bf7ed9853c4868521269f753b0c9d603507d683abadf409d4dd827d3b7d054708c7c75cfa8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
719B

MD5
f34cccb5ec775fe2f4711fce01748a6d

SHA1
a709c21e9f203a148f138ca5421dada812136e80

SHA256
2ebb3751f6c0cd6a44c4c22eacc11e7439b99cee490e01acdc0bf323a470b9e2

SHA512
4993359f90e33b63711c040fade585055744bc13bf42e05f982000f61152ffc757486c516549aa74980f767f6211b9242a91f314efb08954dda40723a1c08b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat

Filesize
195B

MD5
aaaca0e2583f709da65359fd8e40c025

SHA1
8dff547a704a2abdc8c20ebf312e900f0af76d9c

SHA256
89601d05092ef6ff5ef22b238d9f58c108330d9210f5b4bb0f2b95feaffc0a11

SHA512
523e4986891292b9d2a0f5d8fd0f1b519d7c0bca1ab5720c6c47d89d499cad8ba7d1e2688e135117ac3d39fc9cdbba1906e5da11c3e917934c0cbc987d3721fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Or3SRhMf8V.bat

Filesize
195B

MD5
ecf3b4bd07ffef0fdb0233ffef74eaf9

SHA1
c6eb3109a50b205ef8b1ae992163d3aa9f2fe812

SHA256
367404ef0342c6afa03f31d64fedad06352f8b597d7bfb755fad9dd46c976fb9

SHA512
291b6f8af665d10206d0d5ed091a75410e2bbee7c5b62fed07ec3ccc180f97dd7069e490076cfc0d297f570680804e9c680fc37b9b3f77da10acd7e0d51e8b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUJOSyqox9.bat

Filesize
195B

MD5
5c91b445b8aab7229e912cf49d8cfd58

SHA1
4b005d00159cb9d653ed630ca4cf562eceec8384

SHA256
2de7ba57b1dbe79ecc5e1e1240104d0cf9387a7fdfba74fa6b949e1334d6e3e0

SHA512
b99ae8a1dc06f79b13a73185e2659931676b78d3b9eeb32c3f02809906939ec2513510de68ec43dc253ebefc4c0576ddb110bc4c5ad738e5ab9331a0776ad822

Download Submit
C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat

Filesize
195B

MD5
c1e0c95fb9376e4f63723a7ec6b59874

SHA1
6c8093340e84f91f89698b44b3c24fb3528fb26e

SHA256
87f3d6772be442c767a96f76a16b6312727a6c18b2a0bbdf75908a81955106e4

SHA512
dc068bd7f38a74b3df5bbc23a39edcbb0fe1d47bdec335b2adf4aaf3b6a1cdadaaa451a4839a3228953ec989dd1c7197dbe6854742c91dd7fa4c605800e52b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yvohz7Nokj.bat

Filesize
195B

MD5
e6b492c833b1a25ee9f359bfc2a763b6

SHA1
4c2d63fa8231588786d4aa669e5c1ddfdb1cdea1

SHA256
e204be95f0ec8bd22a3af7e40878b611d5d338d0e029fe52f7fc62bdf34bec3c

SHA512
a248a27266f7cf306155b8f7c6121210c4ba35a264df1b150faae940dc3499c21699e40d824fbfe7d2f8625b79088133d85396be5db1840c30d7b8bf177e6677

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat

Filesize
195B

MD5
22972aae5f3956768eb9264508c940de

SHA1
8705142d13483601989b59e159a3be7c2e68bdfc

SHA256
882ce6e69af0373a261e4a10f34b279a2c3acb845cf7e252b27a98105a47d75b

SHA512
cf93bcd9d69bf8b9137dfdd4b106d5e11b789b7fa7a143533b92ce3b04dcee96e2321b611835026820a133a916d2e95d77115fc92d2cc3e44403afdd7d4395b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat

Filesize
195B

MD5
6f99e8a9884a5c58c9b45fffe932ea94

SHA1
73d16f02194f5fd84f5961a2b49ff1b74eb5aed3

SHA256
3b19b7098db88abcc3badd3900576f6a7df58c9d59028c846a9d386dbc33e5e9

SHA512
64d2f339acf65f94af674b399537b4bb998be580ce4768e95da8bea9f55550d9373124b63b5e7edba5e845f47662186d9ce53c6b9595881b2bd4a4bd7df045ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat

Filesize
195B

MD5
41c560bf7ae7adde1a76256cf7f6f799

SHA1
14d4abaf60f04c3ad8a7110920ab65642820b78e

SHA256
c00537ca651341843dfe6b89a5e553a29a5349fc2339629cdbebcb29e50bd6b5

SHA512
4cc84f18d3b99e8971a36128d4836d338618bc62ed3b6c43d067691e45b36edd0265ba626e8be51001f44150c5289ea093dfbc4681c999ea3dae3aae00d491d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat

Filesize
195B

MD5
99bbb9c2d623e77acaed9892fbc37c9a

SHA1
94d42ab5231b74df8a0316d49323c594eecd6b91

SHA256
4062aea7fbceef2d87c17c8c484e2fcb19c8d7995cb44a29c8885ba684052437

SHA512
4947e3a934db8b4d2c1d38ac1a1fa0b3e554d307f03d0ffccc40c570103150c11076494a3256c1061296e3f83372a5b50936309c0facef4201de5f624e1794c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\uVa8TbDE3p.bat

Filesize
195B

MD5
ebc75534024a93c800a2c60e6162fecd

SHA1
797ca50904650d91b065519ddd507579c40e4f9c

SHA256
37207906b7df4635d8143227a7e32cfa3dfacf212f1a043599fd25cae9f058cd

SHA512
96f01c4bcf64ea4a6d53c3a4a095f4c460b67a147fe5b7fcf46baede219139b114ca8c1c87213ba6511ad1085fc2e30652dd778c4465912b01a9513b74c3b530

Download Submit
C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat

Filesize
195B

MD5
02970fbedff61df793581f3772fb7b6e

SHA1
8891ce6bee58e51ba3ed931e1bb6f70fe88c7fc5

SHA256
d6b0e55a75e6314c6fb65f9110c473b7ead086a03a497f65e7ec5cc972ae80bb

SHA512
19dc1010fa021699babc4540f6338dd113731fc52d9cf253733ff85f9ab4798c8c852278e8939109f91b7582db6a39ec69338c86cfc9805a059ad5d574c37c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

Filesize
195B

MD5
6a7704115967734f3ff155d5a2ed237d

SHA1
7aea0cc11defaf28ac4dc7a8d374bc098b463886

SHA256
af2b28420f5ccd52bc2f93aee58c8dab85c6ff51b00c06171d3d766b655b748d

SHA512
91347a534a72c3dfa8929aea4d93dda2d47c72b991ece493ad93bb7efc6be31ddfa02de4f9774e9558cf1fb74cee988310b2d82eeb7ac7c228176fd4749377b5

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2672-468-0x00000000013A0000-0x00000000013B2000-memory.dmp

Filesize
72KB

Download
memory/2772-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-117-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-116-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/2772-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/3164-496-0x0000000000730000-0x0000000000742000-memory.dmp

Filesize
72KB

Download
memory/3236-308-0x00000155F0A90000-0x00000155F0AB2000-memory.dmp

Filesize
136KB

Download
memory/3284-479-0x00000000015D0000-0x00000000015E2000-memory.dmp

Filesize
72KB

Download
memory/3488-447-0x00000000016F0000-0x0000000001702000-memory.dmp

Filesize
72KB

Download
memory/3572-485-0x00000000012F0000-0x0000000001302000-memory.dmp

Filesize
72KB

Download
memory/4340-317-0x000001967B790000-0x000001967B806000-memory.dmp

Filesize
472KB

Download
memory/4820-282-0x0000000000D20000-0x0000000000E30000-memory.dmp

Filesize
1.1MB

Download
memory/4820-286-0x0000000002EB0000-0x0000000002EBC000-memory.dmp

Filesize
48KB

Download
memory/4820-285-0x0000000002EA0000-0x0000000002EAC000-memory.dmp

Filesize
48KB

Download
memory/4820-284-0x00000000015E0000-0x00000000015EC000-memory.dmp

Filesize
48KB

Download
memory/4820-283-0x00000000015D0000-0x00000000015E2000-memory.dmp

Filesize
72KB

Download
memory/5072-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/5072-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download