dcrat | cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb

Analysis

max time kernel
150s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02-11-2022 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe
Size

1.3MB
MD5

cc830a401e44128df7ea075e69303b32
SHA1

2a8eac67c16c9a8c106cd7b472080c5baa95c3f1
SHA256

cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb
SHA512

752d383458dc68c3cd1b39cb13d4104c3a5da6f3502c4c07111d7ebbb87253f68732c61cfef77f8030f99dae9819decb51511cfea092cf919afa0f3deba8f49d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	4672	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	4672	schtasks.exe	71

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac5c-280.dat	dcrat
behavioral1/files/0x000800000001ac5c-281.dat	dcrat
behavioral1/memory/3552-282-0x0000000000C00000-0x0000000000D10000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac61-306.dat	dcrat
behavioral1/files/0x000600000001ac61-307.dat	dcrat
behavioral1/files/0x000600000001ac61-541.dat	dcrat
behavioral1/files/0x000600000001ac61-547.dat	dcrat
behavioral1/files/0x000600000001ac61-553.dat	dcrat
behavioral1/files/0x000600000001ac61-558.dat	dcrat
behavioral1/files/0x000600000001ac61-564.dat	dcrat
behavioral1/files/0x000600000001ac61-569.dat	dcrat
behavioral1/files/0x000600000001ac61-574.dat	dcrat
behavioral1/files/0x000600000001ac61-580.dat	dcrat
behavioral1/files/0x000600000001ac61-585.dat	dcrat
behavioral1/files/0x000600000001ac61-590.dat	dcrat
behavioral1/files/0x000600000001ac61-595.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
3552	DllCommonsvc.exe
2196	System.exe
4084	System.exe
1000	System.exe
4576	System.exe
1052	System.exe
652	System.exe
2236	System.exe
748	System.exe
2876	System.exe
5016	System.exe
3920	System.exe
4508	System.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5b884080fd4f94	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4756	schtasks.exe
4708	schtasks.exe
416	schtasks.exe
3856	schtasks.exe
4620	schtasks.exe
4864	schtasks.exe
4820	schtasks.exe
4944	schtasks.exe
4736	schtasks.exe
3560	schtasks.exe
4904	schtasks.exe
3712	schtasks.exe
4592	schtasks.exe
4964	schtasks.exe
512	schtasks.exe
4928	schtasks.exe
4712	schtasks.exe
1012	schtasks.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	System.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3552	DllCommonsvc.exe
1340	powershell.exe
1128	powershell.exe
1268	powershell.exe
3172	powershell.exe
1464	powershell.exe
1128	powershell.exe
708	powershell.exe
4972	powershell.exe
2196	System.exe
708	powershell.exe
3172	powershell.exe
1128	powershell.exe
4972	powershell.exe
1340	powershell.exe
3172	powershell.exe
708	powershell.exe
1464	powershell.exe
1268	powershell.exe
4972	powershell.exe
1340	powershell.exe
1464	powershell.exe
1268	powershell.exe
4084	System.exe
1000	System.exe
4576	System.exe
1052	System.exe
652	System.exe
2236	System.exe
748	System.exe
2876	System.exe
5016	System.exe
3920	System.exe
4508	System.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	DllCommonsvc.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	2196	System.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe
Token: SeManageVolumePrivilege	1128	powershell.exe
Token: 33	1128	powershell.exe
Token: 34	1128	powershell.exe
Token: 35	1128	powershell.exe
Token: 36	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	3172	powershell.exe
Token: SeSecurityPrivilege	3172	powershell.exe
Token: SeTakeOwnershipPrivilege	3172	powershell.exe
Token: SeLoadDriverPrivilege	3172	powershell.exe
Token: SeSystemProfilePrivilege	3172	powershell.exe
Token: SeSystemtimePrivilege	3172	powershell.exe
Token: SeProfSingleProcessPrivilege	3172	powershell.exe
Token: SeIncBasePriorityPrivilege	3172	powershell.exe
Token: SeCreatePagefilePrivilege	3172	powershell.exe
Token: SeBackupPrivilege	3172	powershell.exe
Token: SeRestorePrivilege	3172	powershell.exe
Token: SeShutdownPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeSystemEnvironmentPrivilege	3172	powershell.exe
Token: SeRemoteShutdownPrivilege	3172	powershell.exe
Token: SeUndockPrivilege	3172	powershell.exe
Token: SeManageVolumePrivilege	3172	powershell.exe
Token: 33	3172	powershell.exe
Token: 34	3172	powershell.exe
Token: 35	3172	powershell.exe
Token: 36	3172	powershell.exe
Token: SeIncreaseQuotaPrivilege	708	powershell.exe
Token: SeSecurityPrivilege	708	powershell.exe
Token: SeTakeOwnershipPrivilege	708	powershell.exe
Token: SeLoadDriverPrivilege	708	powershell.exe
Token: SeSystemProfilePrivilege	708	powershell.exe
Token: SeSystemtimePrivilege	708	powershell.exe
Token: SeProfSingleProcessPrivilege	708	powershell.exe
Token: SeIncBasePriorityPrivilege	708	powershell.exe
Token: SeCreatePagefilePrivilege	708	powershell.exe
Token: SeBackupPrivilege	708	powershell.exe
Token: SeRestorePrivilege	708	powershell.exe
Token: SeShutdownPrivilege	708	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3420	3768	cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe	67
PID 3768 wrote to memory of 3420	3768	cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe	67
PID 3768 wrote to memory of 3420	3768	cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe	67
PID 3420 wrote to memory of 4228	3420	WScript.exe	68
PID 3420 wrote to memory of 4228	3420	WScript.exe	68
PID 3420 wrote to memory of 4228	3420	WScript.exe	68
PID 4228 wrote to memory of 3552	4228	cmd.exe	70
PID 4228 wrote to memory of 3552	4228	cmd.exe	70
PID 3552 wrote to memory of 1268	3552	DllCommonsvc.exe	92
PID 3552 wrote to memory of 1268	3552	DllCommonsvc.exe	92
PID 3552 wrote to memory of 1128	3552	DllCommonsvc.exe	91
PID 3552 wrote to memory of 1128	3552	DllCommonsvc.exe	91
PID 3552 wrote to memory of 1340	3552	DllCommonsvc.exe	94
PID 3552 wrote to memory of 1340	3552	DllCommonsvc.exe	94
PID 3552 wrote to memory of 1464	3552	DllCommonsvc.exe	98
PID 3552 wrote to memory of 1464	3552	DllCommonsvc.exe	98
PID 3552 wrote to memory of 708	3552	DllCommonsvc.exe	97
PID 3552 wrote to memory of 708	3552	DllCommonsvc.exe	97
PID 3552 wrote to memory of 3172	3552	DllCommonsvc.exe	103
PID 3552 wrote to memory of 3172	3552	DllCommonsvc.exe	103
PID 3552 wrote to memory of 4972	3552	DllCommonsvc.exe	102
PID 3552 wrote to memory of 4972	3552	DllCommonsvc.exe	102
PID 3552 wrote to memory of 2196	3552	DllCommonsvc.exe	104
PID 3552 wrote to memory of 2196	3552	DllCommonsvc.exe	104
PID 2196 wrote to memory of 4820	2196	System.exe	105
PID 2196 wrote to memory of 4820	2196	System.exe	105
PID 4820 wrote to memory of 3180	4820	cmd.exe	108
PID 4820 wrote to memory of 3180	4820	cmd.exe	108
PID 4820 wrote to memory of 4084	4820	cmd.exe	109
PID 4820 wrote to memory of 4084	4820	cmd.exe	109
PID 4084 wrote to memory of 4504	4084	System.exe	110
PID 4084 wrote to memory of 4504	4084	System.exe	110
PID 4504 wrote to memory of 4384	4504	cmd.exe	112
PID 4504 wrote to memory of 4384	4504	cmd.exe	112
PID 4504 wrote to memory of 1000	4504	cmd.exe	113
PID 4504 wrote to memory of 1000	4504	cmd.exe	113
PID 1000 wrote to memory of 4512	1000	System.exe	114
PID 1000 wrote to memory of 4512	1000	System.exe	114
PID 4512 wrote to memory of 2744	4512	cmd.exe	116
PID 4512 wrote to memory of 2744	4512	cmd.exe	116
PID 4512 wrote to memory of 4576	4512	cmd.exe	117
PID 4512 wrote to memory of 4576	4512	cmd.exe	117
PID 4576 wrote to memory of 4936	4576	System.exe	118
PID 4576 wrote to memory of 4936	4576	System.exe	118
PID 4936 wrote to memory of 4816	4936	cmd.exe	120
PID 4936 wrote to memory of 4816	4936	cmd.exe	120
PID 4936 wrote to memory of 1052	4936	cmd.exe	121
PID 4936 wrote to memory of 1052	4936	cmd.exe	121
PID 1052 wrote to memory of 900	1052	System.exe	122
PID 1052 wrote to memory of 900	1052	System.exe	122
PID 900 wrote to memory of 4164	900	cmd.exe	124
PID 900 wrote to memory of 4164	900	cmd.exe	124
PID 900 wrote to memory of 652	900	cmd.exe	125
PID 900 wrote to memory of 652	900	cmd.exe	125
PID 652 wrote to memory of 3856	652	System.exe	126
PID 652 wrote to memory of 3856	652	System.exe	126
PID 3856 wrote to memory of 3456	3856	cmd.exe	128
PID 3856 wrote to memory of 3456	3856	cmd.exe	128
PID 3856 wrote to memory of 2236	3856	cmd.exe	129
PID 3856 wrote to memory of 2236	3856	cmd.exe	129
PID 2236 wrote to memory of 288	2236	System.exe	130
PID 2236 wrote to memory of 288	2236	System.exe	130
PID 288 wrote to memory of 2648	288	cmd.exe	132
PID 288 wrote to memory of 2648	288	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe
"C:\Users\Admin\AppData\Local\Temp\cef5528011754931208ad2f8c22aaf5ddc5edc541c8d057a2bba7b7cb981bbdb.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\Camera Roll\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\odt\System.exe
        
        "C:\odt\System.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qzqLwOyuSO.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3180
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gPrDhQDX5J.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4384
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2744
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4816
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4164
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3456
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2648
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KwQfKFARzT.bat"
        20⤵
        
        PID:1776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3496
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\61cJPf1Vjg.bat"
        22⤵
        
        PID:5012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1136
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rHhDMS4c5i.bat"
        24⤵
        
        PID:3172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4148
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUc4JDtx8N.bat"
        26⤵
        
        PID:1088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4968
        
        C:\odt\System.exe
        
        "C:\odt\System.exe"
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"
        28⤵
        
        PID:1896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Pictures\Camera Roll\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Pictures\Camera Roll\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft OneDrive\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft OneDrive\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dab4ea652440e632df6364886c64c6df

SHA1
196b07ed8d0931997e8a9e914daa9824789bcf9f

SHA256
064fdca0dc40cb295260d714b64c0599efe1b883f165c8567fc214f7ca4cc51f

SHA512
deefc657a06fda1da07022b4c7573e72f8dfe575b2aafdb29b3b2fa939351d2b74bcbb92935812b2fee544c2dcbaa8fc375ea5e4fa1be1dd392faed95805d733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dab4ea652440e632df6364886c64c6df

SHA1
196b07ed8d0931997e8a9e914daa9824789bcf9f

SHA256
064fdca0dc40cb295260d714b64c0599efe1b883f165c8567fc214f7ca4cc51f

SHA512
deefc657a06fda1da07022b4c7573e72f8dfe575b2aafdb29b3b2fa939351d2b74bcbb92935812b2fee544c2dcbaa8fc375ea5e4fa1be1dd392faed95805d733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
82050b93958fb42e17635f452d51d5c0

SHA1
67fc612c03ec0d8fb928400baee49762179e3872

SHA256
43835d7bdc8288b96a6d2a7156cbdeac2c99cdd52fcb26b3ec7665f6d0baee32

SHA512
a0a2716210fbb87cbe523b86f62118657d2c3b1cf59353343c050de0961059fc1fe089d9f82f263b165a491a3079ef38a122202e969ff5410160f9b913a477f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aae3539f375d3254e1b43d0cea2066fc

SHA1
ccbf856bfbe9732ca6f31411698da4f059801757

SHA256
4583bd5b6c9addc791fc7ce93e9d3cf1bd1f8037e51e175b4e7f8644710a110c

SHA512
f9a7bff2eac9d1414ebe6f40f0618755eae973e640d1c4536658ae2de1ec796c491ea243a8ac32698ca5ebb84bb824f2c9888a9627bff441c53aa1dea451c935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aae3539f375d3254e1b43d0cea2066fc

SHA1
ccbf856bfbe9732ca6f31411698da4f059801757

SHA256
4583bd5b6c9addc791fc7ce93e9d3cf1bd1f8037e51e175b4e7f8644710a110c

SHA512
f9a7bff2eac9d1414ebe6f40f0618755eae973e640d1c4536658ae2de1ec796c491ea243a8ac32698ca5ebb84bb824f2c9888a9627bff441c53aa1dea451c935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5128f67a42e2d9788027248dfbd0e605

SHA1
4e8e1c6eabe3c2501856538baf55fa28d36684ac

SHA256
ebb9c8b00276cf1a3bb94c5d4e3f52ddcb19aaf6258a3950303133873a58b207

SHA512
b331cbdf6b71fdd051dd78eafb3fbe04d01da34d1b1e03f2f165847396ad2d27e3e58fc8556927852efaed622f27948404ead1d095437247616ef30a519deefa

Download Submit
C:\Users\Admin\AppData\Local\Temp\61cJPf1Vjg.bat

Filesize
182B

MD5
81546dfa999fc335514bdb2e2d5d4683

SHA1
60d34d6262b70cf056e61056a4d8098767b82af9

SHA256
48ec3be610faed6611f819e99ea3902db48fdbc4e0be07ccaeda2ec664f979bf

SHA512
78cdd51949782802b392fdf9fac0fc94225b85579df23b094ee712eddab4df58bbed4f1cb079d07acbd458889a5b98024fc80ee823bad4c2eb21d82b77bbadbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat

Filesize
182B

MD5
116290c03ae824c1deed210bd52ddb0b

SHA1
f44ba3114766404bf582b59a58cd7460f9684782

SHA256
a0975c24d367ef7737c382cc3a47e8f9801d48350119872fdbcea9a38132305a

SHA512
3360b9868ae5e78b5304bf982ca653001d21f0c311d96afcd6b4d40660ffae10cc58ae44bc78c886c797a77bfaf6e2121c10066f93ffc22dd1ee32a4e9cd4c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iu2jWrKESR.bat

Filesize
182B

MD5
75b7acdee7b64e631982c51d89189e8a

SHA1
94f456e3feaf82ec7b499750187d09b2ec1438ef

SHA256
330086280c608a1d8900e6c84fee098213df5e00e5bf1103a5c22567307a0000

SHA512
6afe4cd57a4e146ac707319cca3dbb3fb6ed4791ba1c4d35ef37839c6af9ea530ca94bd784de7007c39d6d426a37dbe66f48ccdca4dc66c5ddf6fa5b29595f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\KwQfKFARzT.bat

Filesize
182B

MD5
7a0eaa76e2b5528e6e58abc6f94169f2

SHA1
5056dcb8b68fbf2bbf6309693547cae6db03cdb0

SHA256
e5b56dab080dfa6b153297babdcfcdf9c19529531148971fbf4183a496c4b37b

SHA512
0da87a01b7960b166f170090a6b14ca5304ebce3d6981f2afb536da1cb6dc8318a68202f21855b3ce6b8f8feb81d0eed6f85f2d01ca106d64bd0ace70afd5513

Download Submit
C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat

Filesize
182B

MD5
2de1508375582834b063ddb41771bf3d

SHA1
0cdcdb7944d541e9ce446a947e2b7659d7a84d8e

SHA256
36bc886ba13f33546f850c005f96a3c418c0a2d32c2f0d15eafbd680ba78c75f

SHA512
c44bfdbc7c1ff9c9c74d969893b2737cf67d778db9d957415269d58d2faf001b2517c41744a0d9878143a47e497185ec088cb8ae3a51a63484528ac081eb17b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gPrDhQDX5J.bat

Filesize
182B

MD5
5273d837921aa28c75bdeaa9b7e801d9

SHA1
35fd9549139895dbf8914d1c3ffdf3623a1dce61

SHA256
85931f52a0a5c6d47f549332b3bbb4d740315453b9402147a06402a1fda97248

SHA512
5e10a914ddbc02327ee506a4541e230a3592a0cedd7d13fec8cdd56b5f3f1b437e35166c1796a820b7eafcface5a0d37251fd26fd0058e6a10c3f4f1ed7d3668

Download Submit
C:\Users\Admin\AppData\Local\Temp\kUc4JDtx8N.bat

Filesize
182B

MD5
67b430a582e3e54802a79f0c2f0fbd1d

SHA1
5f78c4465726dfcdc0129d5c46ba6185268fccd3

SHA256
1eea7d7e50d5167b4376e680549f5acf1dc8e485fa157f8355c998e7e038d91a

SHA512
763073dc6731b23e558d625f969427c0faa9fa02ef74d4a90adf41aee1f52f168428d6e103d7af9d793f7b489283425f7ec0b1ab70d1a0741758b83bdef2c88c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qzqLwOyuSO.bat

Filesize
182B

MD5
581223c96002a49cd237d915e51a3023

SHA1
92935529d3585727d6aa14f5fa3e44827badf481

SHA256
f5151813e23b27615cc4820acb59d8be56a5a444e2b0e893cc4b63cc910520a7

SHA512
a0f5063de7c9d83936c540b2955181d6b65102e8679261045b94e6c016516fb2ceab03298b4b07dc1125ffe66dfc7b7207acc8b98ac0cc4b55316b92899db431

Download Submit
C:\Users\Admin\AppData\Local\Temp\rHhDMS4c5i.bat

Filesize
182B

MD5
1e411f2a514024a0bc790d0f2cdfcf45

SHA1
67bbe20531dc8a40deab4503cac205914804b071

SHA256
a3bcd9af30b57a0d91a8b3692b0d4608c34f975e554d31a8c00bb17b669b27d4

SHA512
48c5f68a62e3477f75f94c3c827881cd25692377012cb96ed3c98d1880fd29004addc0531f6671b3c6e80aac9293e9e80a977e2d3a6859711bf2cf7929dca7a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat

Filesize
182B

MD5
8778fb9861dda332f81c60e7cf9b986b

SHA1
11afec5488d9383a1df85ebef1134400954fc5de

SHA256
95f586581d2ea5bc7029ade64be94c1573a5275cad09d1fd1226300aa3a6027f

SHA512
3559e97e0dfed0744f7ec0431f2227b7934901f7ec4845b19be6ea7b39f98a1e7aae72f02259eca72d9d47936956a4ad62a56d3498498b8a068564e47d2dd18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat

Filesize
182B

MD5
dac3f4346132176264cdfeb41ae4b851

SHA1
1e7ff6d02f1b9fcb506568ac67d4435ef518df57

SHA256
5ea7c932ef46552c3ac7c5af445fb58b9b7efcb58e84e7bc612a7e45deb879d3

SHA512
2e22a0aaed28ea8dc69fd6b38b4125e32d62666d59e0a8333643a3ce0de46ab7eae317e48ee4eba1757519720adfc2b7f491235375323f73c088ba7ea6ee94f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat

Filesize
182B

MD5
0e6659f9dcfd7831a7494cde51c46fd8

SHA1
bc8b730fb1ebdfe6ce5ea0d00d7464a67a1a0e15

SHA256
637342e97f3bed79a3b12716ace4e47a9fc193dd0d3197fdd0fbdf923a0370ba

SHA512
d67ae3b89db62265739c9594724cdfc3fa8dbb78a25caffcb2f82b1d4248787e230312c18df673651d4c2661c3e0be4a6256c19672e456fe36bf4c4d8d2a8c14

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/288-570-0x0000000000000000-mapping.dmp

Download
memory/652-563-0x0000000000000000-mapping.dmp

Download
memory/708-291-0x0000000000000000-mapping.dmp

Download
memory/748-573-0x0000000000000000-mapping.dmp

Download
memory/748-575-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/900-560-0x0000000000000000-mapping.dmp

Download
memory/1000-548-0x0000000001240000-0x0000000001252000-memory.dmp

Filesize
72KB

Download
memory/1000-546-0x0000000000000000-mapping.dmp

Download
memory/1052-559-0x00000000010A0000-0x00000000010B2000-memory.dmp

Filesize
72KB

Download
memory/1052-557-0x0000000000000000-mapping.dmp

Download
memory/1088-591-0x0000000000000000-mapping.dmp

Download
memory/1128-328-0x000001F872DC0000-0x000001F872E36000-memory.dmp

Filesize
472KB

Download
memory/1128-288-0x0000000000000000-mapping.dmp

Download
memory/1128-325-0x000001F872B00000-0x000001F872B22000-memory.dmp

Filesize
136KB

Download
memory/1136-583-0x0000000000000000-mapping.dmp

Download
memory/1268-287-0x0000000000000000-mapping.dmp

Download
memory/1340-289-0x0000000000000000-mapping.dmp

Download
memory/1464-290-0x0000000000000000-mapping.dmp

Download
memory/1776-576-0x0000000000000000-mapping.dmp

Download
memory/1896-596-0x0000000000000000-mapping.dmp

Download
memory/2196-302-0x0000000000000000-mapping.dmp

Download
memory/2236-568-0x0000000000000000-mapping.dmp

Download
memory/2648-572-0x0000000000000000-mapping.dmp

Download
memory/2744-551-0x0000000000000000-mapping.dmp

Download
memory/2876-579-0x0000000000000000-mapping.dmp

Download
memory/3172-292-0x0000000000000000-mapping.dmp

Download
memory/3172-586-0x0000000000000000-mapping.dmp

Download
memory/3180-511-0x0000000000000000-mapping.dmp

Download
memory/3420-182-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-180-0x0000000000000000-mapping.dmp

Download
memory/3456-567-0x0000000000000000-mapping.dmp

Download
memory/3460-598-0x0000000000000000-mapping.dmp

Download
memory/3496-578-0x0000000000000000-mapping.dmp

Download
memory/3552-279-0x0000000000000000-mapping.dmp

Download
memory/3552-282-0x0000000000C00000-0x0000000000D10000-memory.dmp

Filesize
1.1MB

Download
memory/3552-283-0x0000000002D60000-0x0000000002D72000-memory.dmp

Filesize
72KB

Download
memory/3552-284-0x0000000002D70000-0x0000000002D7C000-memory.dmp

Filesize
48KB

Download
memory/3552-285-0x0000000002D80000-0x0000000002D8C000-memory.dmp

Filesize
48KB

Download
memory/3552-286-0x0000000002D90000-0x0000000002D9C000-memory.dmp

Filesize
48KB

Download
memory/3768-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3768-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3856-565-0x0000000000000000-mapping.dmp

Download
memory/3920-589-0x0000000000000000-mapping.dmp

Download
memory/4084-540-0x0000000000000000-mapping.dmp

Download
memory/4148-588-0x0000000000000000-mapping.dmp

Download
memory/4164-562-0x0000000000000000-mapping.dmp

Download
memory/4228-256-0x0000000000000000-mapping.dmp

Download
memory/4384-545-0x0000000000000000-mapping.dmp

Download
memory/4504-543-0x0000000000000000-mapping.dmp

Download
memory/4508-594-0x0000000000000000-mapping.dmp

Download
memory/4512-549-0x0000000000000000-mapping.dmp

Download
memory/4576-552-0x0000000000000000-mapping.dmp

Download
memory/4816-556-0x0000000000000000-mapping.dmp

Download
memory/4820-476-0x0000000000000000-mapping.dmp

Download
memory/4936-554-0x0000000000000000-mapping.dmp

Download
memory/4968-593-0x0000000000000000-mapping.dmp

Download
memory/4972-293-0x0000000000000000-mapping.dmp

Download
memory/5012-581-0x0000000000000000-mapping.dmp

Download
memory/5016-584-0x0000000000000000-mapping.dmp

Download