dcrat | 172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe
Size

1.3MB
MD5

a1ac1dc15ceb3a08b02c2e6ac427b8d3
SHA1

bd97144e3ccedfeb60050687be5870583b96764d
SHA256

172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b
SHA512

60a5d15b05b76840c0c5f8d71896135305b81d06ac605690b81e90269bf715d22339825ac6f7bfc7bfcbc8cd34de2155006272c762e113702b479184d30b1627
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	3180	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3180	schtasks.exe

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/4696-139-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat
C:\Users\Admin\Links\SppExtComObj.exe	dcrat

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DllCommonsvc.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeWScript.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exe172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe

Executes dropped EXE 11 IoCs

Processes:

DllCommonsvc.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exe

pid	process
4696	DllCommonsvc.exe
4796	SppExtComObj.exe
1568	SppExtComObj.exe
908	SppExtComObj.exe
4160	SppExtComObj.exe
4504	SppExtComObj.exe
1876	SppExtComObj.exe
744	SppExtComObj.exe
2156	SppExtComObj.exe
1356	SppExtComObj.exe
4564	SppExtComObj.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 3 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\it\taskhostw.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\SysWOW64\it\taskhostw.exe	DllCommonsvc.exe
File created	C:\Windows\SysWOW64\it\ea9f0e6c9e2dcd	DllCommonsvc.exe

Drops file in Program Files directory 3 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\6203df4a6bafc7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
872	schtasks.exe
4268	schtasks.exe
2156	schtasks.exe
1340	schtasks.exe
4820	schtasks.exe
4264	schtasks.exe
3464	schtasks.exe
3796	schtasks.exe
3676	schtasks.exe
3648	schtasks.exe
4700	schtasks.exe
1720	schtasks.exe
4448	schtasks.exe
4740	schtasks.exe
228	schtasks.exe
1664	schtasks.exe
2300	schtasks.exe
2504	schtasks.exe
2432	schtasks.exe
3188	schtasks.exe
1788	schtasks.exe
1456	schtasks.exe
1532	schtasks.exe
3008	schtasks.exe
1060	schtasks.exe
3636	schtasks.exe
3176	schtasks.exe

Modifies registry class 11 IoCs

Processes:

SppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exe172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exeDllCommonsvc.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	SppExtComObj.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exeSppExtComObj.exe

pid	process
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
4696	DllCommonsvc.exe
524	powershell.exe
2112	powershell.exe
2112	powershell.exe
524	powershell.exe
5084	powershell.exe
5084	powershell.exe
2852	powershell.exe
2852	powershell.exe
3620	powershell.exe
3620	powershell.exe
3460	powershell.exe
3460	powershell.exe
2640	powershell.exe
2640	powershell.exe
2500	powershell.exe
2500	powershell.exe
4084	powershell.exe
4084	powershell.exe
1176	powershell.exe
1176	powershell.exe
524	powershell.exe
2112	powershell.exe
2852	powershell.exe
3620	powershell.exe
5084	powershell.exe
4084	powershell.exe
1176	powershell.exe
3460	powershell.exe
2640	powershell.exe
2500	powershell.exe
4796	SppExtComObj.exe
1568	SppExtComObj.exe
908	SppExtComObj.exe
4160	SppExtComObj.exe
4504	SppExtComObj.exe
1876	SppExtComObj.exe
744	SppExtComObj.exe
2156	SppExtComObj.exe
1356	SppExtComObj.exe
4564	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	4696	DllCommonsvc.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	4796	SppExtComObj.exe
Token: SeDebugPrivilege	1568	SppExtComObj.exe
Token: SeDebugPrivilege	908	SppExtComObj.exe
Token: SeDebugPrivilege	4160	SppExtComObj.exe
Token: SeDebugPrivilege	4504	SppExtComObj.exe
Token: SeDebugPrivilege	1876	SppExtComObj.exe
Token: SeDebugPrivilege	744	SppExtComObj.exe
Token: SeDebugPrivilege	2156	SppExtComObj.exe
Token: SeDebugPrivilege	1356	SppExtComObj.exe
Token: SeDebugPrivilege	4564	SppExtComObj.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exeWScript.execmd.exeDllCommonsvc.execmd.exeSppExtComObj.execmd.exeSppExtComObj.execmd.exeSppExtComObj.execmd.exeSppExtComObj.execmd.exeSppExtComObj.execmd.exe

description	pid	process	target process
PID 4976 wrote to memory of 3480	4976	172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe	WScript.exe
PID 4976 wrote to memory of 3480	4976	172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe	WScript.exe
PID 4976 wrote to memory of 3480	4976	172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe	WScript.exe
PID 3480 wrote to memory of 5004	3480	WScript.exe	cmd.exe
PID 3480 wrote to memory of 5004	3480	WScript.exe	cmd.exe
PID 3480 wrote to memory of 5004	3480	WScript.exe	cmd.exe
PID 5004 wrote to memory of 4696	5004	cmd.exe	DllCommonsvc.exe
PID 5004 wrote to memory of 4696	5004	cmd.exe	DllCommonsvc.exe
PID 4696 wrote to memory of 3620	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 3620	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 5084	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 5084	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2112	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2112	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 3460	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 3460	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 524	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 524	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 4084	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 4084	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2852	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2852	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2640	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2640	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2500	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 2500	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 1176	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 1176	4696	DllCommonsvc.exe	powershell.exe
PID 4696 wrote to memory of 4964	4696	DllCommonsvc.exe	cmd.exe
PID 4696 wrote to memory of 4964	4696	DllCommonsvc.exe	cmd.exe
PID 4964 wrote to memory of 2232	4964	cmd.exe	w32tm.exe
PID 4964 wrote to memory of 2232	4964	cmd.exe	w32tm.exe
PID 4964 wrote to memory of 4796	4964	cmd.exe	SppExtComObj.exe
PID 4964 wrote to memory of 4796	4964	cmd.exe	SppExtComObj.exe
PID 4796 wrote to memory of 4296	4796	SppExtComObj.exe	cmd.exe
PID 4796 wrote to memory of 4296	4796	SppExtComObj.exe	cmd.exe
PID 4296 wrote to memory of 1492	4296	cmd.exe	w32tm.exe
PID 4296 wrote to memory of 1492	4296	cmd.exe	w32tm.exe
PID 4296 wrote to memory of 1568	4296	cmd.exe	SppExtComObj.exe
PID 4296 wrote to memory of 1568	4296	cmd.exe	SppExtComObj.exe
PID 1568 wrote to memory of 2968	1568	SppExtComObj.exe	cmd.exe
PID 1568 wrote to memory of 2968	1568	SppExtComObj.exe	cmd.exe
PID 2968 wrote to memory of 3980	2968	cmd.exe	w32tm.exe
PID 2968 wrote to memory of 3980	2968	cmd.exe	w32tm.exe
PID 2968 wrote to memory of 908	2968	cmd.exe	SppExtComObj.exe
PID 2968 wrote to memory of 908	2968	cmd.exe	SppExtComObj.exe
PID 908 wrote to memory of 808	908	SppExtComObj.exe	cmd.exe
PID 908 wrote to memory of 808	908	SppExtComObj.exe	cmd.exe
PID 808 wrote to memory of 1316	808	cmd.exe	w32tm.exe
PID 808 wrote to memory of 1316	808	cmd.exe	w32tm.exe
PID 808 wrote to memory of 4160	808	cmd.exe	SppExtComObj.exe
PID 808 wrote to memory of 4160	808	cmd.exe	SppExtComObj.exe
PID 4160 wrote to memory of 3120	4160	SppExtComObj.exe	cmd.exe
PID 4160 wrote to memory of 3120	4160	SppExtComObj.exe	cmd.exe
PID 3120 wrote to memory of 5080	3120	cmd.exe	w32tm.exe
PID 3120 wrote to memory of 5080	3120	cmd.exe	w32tm.exe
PID 3120 wrote to memory of 4504	3120	cmd.exe	SppExtComObj.exe
PID 3120 wrote to memory of 4504	3120	cmd.exe	SppExtComObj.exe
PID 4504 wrote to memory of 1008	4504	SppExtComObj.exe	cmd.exe
PID 4504 wrote to memory of 1008	4504	SppExtComObj.exe	cmd.exe
PID 1008 wrote to memory of 3136	1008	cmd.exe	w32tm.exe
PID 1008 wrote to memory of 3136	1008	cmd.exe	w32tm.exe
PID 1008 wrote to memory of 1876	1008	cmd.exe	SppExtComObj.exe
PID 1008 wrote to memory of 1876	1008	cmd.exe	SppExtComObj.exe

C:\Users\Admin\AppData\Local\Temp\172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe
"C:\Users\Admin\AppData\Local\Temp\172af321418b938a65a8c592382b9b07bcee1c3dba9ad5e9df8cb8cde42e0c0b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\it\taskhostw.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Links\SppExtComObj.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\Registry.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AvGBYmjZie.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:2232

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:1492

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
9⤵
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
10⤵
PID:3980

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat"
11⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
12⤵
PID:1316

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F8wGhM86rN.bat"
13⤵
- Suspicious use of WriteProcessMemory
PID:3120

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
14⤵
PID:5080

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat"
15⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
16⤵
PID:3136

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wOqzmeZFfo.bat"
17⤵
PID:4700

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
18⤵
PID:3828

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat"
19⤵
PID:4168

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
20⤵
PID:2240

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat"
21⤵
PID:5116

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
22⤵
PID:1164

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat"
23⤵
PID:4304

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
24⤵
PID:2492

C:\Users\Admin\Links\SppExtComObj.exe
"C:\Users\Admin\Links\SppExtComObj.exe"
24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\SysWOW64\it\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\SysWOW64\it\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\it\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Downloads\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Downloads\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Links\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Links\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Links\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\odt\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log
Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat
Filesize
202B

MD5
eed413e5d9f137b0b785083adb8c41f9

SHA1
795ee6488e2b9223f5a44b376ef518ace1ba3f61

SHA256
a694099b370b3739177a69c28dfee0b6738de69c5a1343fd6f8a4e8c8d60ac35

SHA512
057e3eb9711a0f8c673c619e4cdce6f7552878da7410e387a6bd59eb2ef5261ba5c81ee0998e56e1ae4a9a5781188b4ff416cad18be0813413f560582d84ceef

Download Submit
C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat
Filesize
202B

MD5
c9c7702dd2bee75664fcd1c9869610ef

SHA1
f6c770363fc8cfde432dd9c3328b598e02db7945

SHA256
ff01372018dbdf7175aedb4f9280045052c7a864d33803fed91cb96caad64d0a

SHA512
50898e515582b26efe9e790141ea4c1ab5f5ee934979c5049736a0a3b221c845013fcd061a223c142a5303654e71ef940fa57f86eeaa0ca4d8baad601784d1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\AvGBYmjZie.bat
Filesize
202B

MD5
79da9eebda82404f49599e4feeb6fca4

SHA1
33f1427e38eda05f447289e958ff85ea9dedcc17

SHA256
7921c52cd87db6001bdd00322c99aaaae261cc9383d6b97360a2767cc706ba24

SHA512
c4a62c7306d5a07d937ef843d3a3ff5c030bc15f6d0dd2d3bbb4099c84d441da48f233fe7d6dedc4fb9494b88e3808d0385740bde46fc92cc15955a7df695d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F8wGhM86rN.bat
Filesize
202B

MD5
06afb511c35e2868887665a3653240a6

SHA1
3a154972d4d710fe4973444ed56e987a7931c11a

SHA256
ca48d90f5fd8723c8c130a781a4c357e14af080ad04687218c5146b074fda145

SHA512
385cbacf3183c3bbcb737fc1a8865af67b82ee967e12851007dd58657cdd8f9e22cce311b6a948ae456211d2a05df5ec6d7761245e9a758f4916b77725d44ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat
Filesize
202B

MD5
5047b063a5b927cfc50926d069d3ccd3

SHA1
4ad7e0680648af5c6668555f0523db00536dcaed

SHA256
e2648db777f71fa69ddf705bd648e4a50e2f4d0fd77a269cbf4b1cf965981f77

SHA512
572a8bef354dc782b0ac87d288ac07525d7cc556f9fb8554cfd3661bc66758446d7eaa45164f4aad9cf900ad7d04d3c19d29200dac5ca313891546d153cba14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat
Filesize
202B

MD5
69550fd0d07f1cd7a53fd321fa216a63

SHA1
dcf20ce8da8837a16aba8036769461e4966374a4

SHA256
0800cf5121f7de580dc11b7b38571f22e448622d7e5152812b248224963d62bd

SHA512
243abcb70e078e428bb0b425321b678481a1b7d6b24e2cd2acf31ba81fdc4a352e213a8c286bd18c8c13e150bd2508f968b094ad972f4bd86aa4731163f3bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat
Filesize
202B

MD5
69550fd0d07f1cd7a53fd321fa216a63

SHA1
dcf20ce8da8837a16aba8036769461e4966374a4

SHA256
0800cf5121f7de580dc11b7b38571f22e448622d7e5152812b248224963d62bd

SHA512
243abcb70e078e428bb0b425321b678481a1b7d6b24e2cd2acf31ba81fdc4a352e213a8c286bd18c8c13e150bd2508f968b094ad972f4bd86aa4731163f3bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat
Filesize
202B

MD5
4bd8fe3f928784e6cb857987b6a2c88f

SHA1
85055ee0d8771a4f0a51e756179ecdb5ca6b0ed0

SHA256
3ea884d98dec98873351670acaf52e2c5bd4266e17c83497a6fd810825d955cc

SHA512
a39cc1c9496f9e0a1822df5c38ee36273865d8a22f3a162b18208cde46c3b78d6ff8bb5019be4d02a72dd4a72a5c4eb2b4b70c5986c0de9fc8392251ab6a114e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wOqzmeZFfo.bat
Filesize
202B

MD5
8ad0768882200a78f0ec90fe46f714c9

SHA1
2929cff4e231e3947a17aac5a962573933c1c8b2

SHA256
f3d5a7f748fc34338da3c45abd23872044aab40a70daa58d648ab14552220c1a

SHA512
def4bad2cf15cd78bad940d88a0de6be2fd7e13ff691e5958bb231ab9e8fd9a6ad8bcb61a6db4ca18350e3a2f35fc7fe2415c6850631931f88046f4fee5f9757

Download Submit
C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat
Filesize
202B

MD5
728c8f71241e9d8f286483ccb7251e20

SHA1
ba2ad7347f248564684cff850bd61870aa5634fd

SHA256
9f015e24392ef8debdfe1d967c628b31b49437b856431a8c31d3bb2ef9ff6504

SHA512
8f19489e3b9dc549b7da2aceecea1036827fe46875f6c7cbb32848d0b2b27ac9009ed15f37280978130a9789c72a8a34612038eec2a31492ae086f5b073a6286

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\Links\SppExtComObj.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat
Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/524-145-0x0000000000000000-mapping.dmp

Download
memory/524-156-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/524-176-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/744-236-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/744-230-0x0000000000000000-mapping.dmp

Download
memory/744-232-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/808-205-0x0000000000000000-mapping.dmp

Download
memory/908-208-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/908-204-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/908-202-0x0000000000000000-mapping.dmp

Download
memory/1008-219-0x0000000000000000-mapping.dmp

Download
memory/1164-242-0x0000000000000000-mapping.dmp

Download
memory/1176-164-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/1176-178-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/1176-150-0x0000000000000000-mapping.dmp

Download
memory/1316-207-0x0000000000000000-mapping.dmp

Download
memory/1356-250-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/1356-246-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/1356-244-0x0000000000000000-mapping.dmp

Download
memory/1492-192-0x0000000000000000-mapping.dmp

Download
memory/1568-197-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/1568-194-0x0000000000000000-mapping.dmp

Download
memory/1568-201-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/1876-229-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/1876-223-0x0000000000000000-mapping.dmp

Download
memory/1876-225-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/2112-173-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2112-143-0x0000000000000000-mapping.dmp

Download
memory/2112-157-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2156-237-0x0000000000000000-mapping.dmp

Download
memory/2156-243-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/2156-239-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/2232-159-0x0000000000000000-mapping.dmp

Download
memory/2240-235-0x0000000000000000-mapping.dmp

Download
memory/2492-249-0x0000000000000000-mapping.dmp

Download
memory/2500-149-0x0000000000000000-mapping.dmp

Download
memory/2500-185-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2500-165-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2640-183-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2640-148-0x0000000000000000-mapping.dmp

Download
memory/2640-163-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2852-162-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2852-147-0x0000000000000000-mapping.dmp

Download
memory/2852-153-0x0000020AC8EB0000-0x0000020AC8ED2000-memory.dmp

Filesize
136KB

Download
memory/2852-184-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/2968-198-0x0000000000000000-mapping.dmp

Download
memory/3120-212-0x0000000000000000-mapping.dmp

Download
memory/3136-221-0x0000000000000000-mapping.dmp

Download
memory/3460-144-0x0000000000000000-mapping.dmp

Download
memory/3460-160-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/3460-182-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/3480-132-0x0000000000000000-mapping.dmp

Download
memory/3620-141-0x0000000000000000-mapping.dmp

Download
memory/3620-151-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/3620-177-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/3828-228-0x0000000000000000-mapping.dmp

Download
memory/3980-200-0x0000000000000000-mapping.dmp

Download
memory/4084-146-0x0000000000000000-mapping.dmp

Download
memory/4084-161-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/4084-174-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/4160-211-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/4160-215-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/4160-209-0x0000000000000000-mapping.dmp

Download
memory/4168-233-0x0000000000000000-mapping.dmp

Download
memory/4296-190-0x0000000000000000-mapping.dmp

Download
memory/4304-247-0x0000000000000000-mapping.dmp

Download
memory/4504-216-0x0000000000000000-mapping.dmp

Download
memory/4504-222-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/4504-218-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/4564-253-0x00007FFD705B0000-0x00007FFD71071000-memory.dmp

Filesize
10.8MB

Download
memory/4564-251-0x0000000000000000-mapping.dmp

Download
memory/4696-139-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/4696-155-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/4696-136-0x0000000000000000-mapping.dmp

Download
memory/4696-140-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/4700-226-0x0000000000000000-mapping.dmp

Download
memory/4796-193-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/4796-186-0x0000000000000000-mapping.dmp

Download
memory/4796-189-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/4964-152-0x0000000000000000-mapping.dmp

Download
memory/5004-135-0x0000000000000000-mapping.dmp

Download
memory/5080-214-0x0000000000000000-mapping.dmp

Download
memory/5084-169-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/5084-142-0x0000000000000000-mapping.dmp

Download
memory/5084-154-0x00007FFD70340000-0x00007FFD70E01000-memory.dmp

Filesize
10.8MB

Download
memory/5116-240-0x0000000000000000-mapping.dmp

Download