dcrat | eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe
Size

1.3MB
MD5

09a66dea97fc60f2de26462cc3f286d1
SHA1

6e9a20e29a9eb0504745a1cc2c7f2423f4ded722
SHA256

eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745
SHA512

678959cfb5724fb70cda3382dd68e6ef92c0366a4ba0cdc5e584bc0263e900877a73a07d70e46b60f5e6499b7847eee48d9f5d63728867f8602ad914ca1b7f3a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2744	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2744	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b78-10.dat	dcrat
behavioral2/memory/212-13-0x00000000001C0000-0x00000000002D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4064	powershell.exe
1848	powershell.exe
500	powershell.exe
4732	powershell.exe
4420	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	conhost.exe

Executes dropped EXE 16 IoCs

pid	Process
212	DllCommonsvc.exe
4876	conhost.exe
3748	conhost.exe
4740	conhost.exe
880	conhost.exe
5068	conhost.exe
3124	conhost.exe
2044	conhost.exe
4924	conhost.exe
1980	conhost.exe
3548	conhost.exe
3636	conhost.exe
1856	conhost.exe
2284	conhost.exe
3372	conhost.exe
4564	conhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
53	raw.githubusercontent.com
41	raw.githubusercontent.com
45	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
25	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
19	raw.githubusercontent.com
39	raw.githubusercontent.com
40	raw.githubusercontent.com
46	raw.githubusercontent.com
47	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ShellComponents\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\ShellComponents\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	conhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5056	schtasks.exe
3636	schtasks.exe
3020	schtasks.exe
372	schtasks.exe
4396	schtasks.exe
2656	schtasks.exe
3328	schtasks.exe
2596	schtasks.exe
2844	schtasks.exe
1540	schtasks.exe
1044	schtasks.exe
3508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
212	DllCommonsvc.exe
500	powershell.exe
1848	powershell.exe
4732	powershell.exe
4420	powershell.exe
4064	powershell.exe
1848	powershell.exe
4876	conhost.exe
500	powershell.exe
4732	powershell.exe
4420	powershell.exe
4064	powershell.exe
3748	conhost.exe
4740	conhost.exe
880	conhost.exe
5068	conhost.exe
3124	conhost.exe
2044	conhost.exe
4924	conhost.exe
1980	conhost.exe
3548	conhost.exe
3636	conhost.exe
1856	conhost.exe
2284	conhost.exe
3372	conhost.exe
4564	conhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	DllCommonsvc.exe
Token: SeDebugPrivilege	500	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4876	conhost.exe
Token: SeDebugPrivilege	3748	conhost.exe
Token: SeDebugPrivilege	4740	conhost.exe
Token: SeDebugPrivilege	880	conhost.exe
Token: SeDebugPrivilege	5068	conhost.exe
Token: SeDebugPrivilege	3124	conhost.exe
Token: SeDebugPrivilege	2044	conhost.exe
Token: SeDebugPrivilege	4924	conhost.exe
Token: SeDebugPrivilege	1980	conhost.exe
Token: SeDebugPrivilege	3548	conhost.exe
Token: SeDebugPrivilege	3636	conhost.exe
Token: SeDebugPrivilege	1856	conhost.exe
Token: SeDebugPrivilege	2284	conhost.exe
Token: SeDebugPrivilege	3372	conhost.exe
Token: SeDebugPrivilege	4564	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2788	3192	JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe	83
PID 3192 wrote to memory of 2788	3192	JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe	83
PID 3192 wrote to memory of 2788	3192	JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe	83
PID 2788 wrote to memory of 1552	2788	WScript.exe	85
PID 2788 wrote to memory of 1552	2788	WScript.exe	85
PID 2788 wrote to memory of 1552	2788	WScript.exe	85
PID 1552 wrote to memory of 212	1552	cmd.exe	87
PID 1552 wrote to memory of 212	1552	cmd.exe	87
PID 212 wrote to memory of 4064	212	DllCommonsvc.exe	102
PID 212 wrote to memory of 4064	212	DllCommonsvc.exe	102
PID 212 wrote to memory of 1848	212	DllCommonsvc.exe	103
PID 212 wrote to memory of 1848	212	DllCommonsvc.exe	103
PID 212 wrote to memory of 500	212	DllCommonsvc.exe	104
PID 212 wrote to memory of 500	212	DllCommonsvc.exe	104
PID 212 wrote to memory of 4732	212	DllCommonsvc.exe	105
PID 212 wrote to memory of 4732	212	DllCommonsvc.exe	105
PID 212 wrote to memory of 4420	212	DllCommonsvc.exe	106
PID 212 wrote to memory of 4420	212	DllCommonsvc.exe	106
PID 212 wrote to memory of 4876	212	DllCommonsvc.exe	111
PID 212 wrote to memory of 4876	212	DllCommonsvc.exe	111
PID 4876 wrote to memory of 3628	4876	conhost.exe	119
PID 4876 wrote to memory of 3628	4876	conhost.exe	119
PID 3628 wrote to memory of 2964	3628	cmd.exe	121
PID 3628 wrote to memory of 2964	3628	cmd.exe	121
PID 3628 wrote to memory of 3748	3628	cmd.exe	129
PID 3628 wrote to memory of 3748	3628	cmd.exe	129
PID 3748 wrote to memory of 3512	3748	conhost.exe	131
PID 3748 wrote to memory of 3512	3748	conhost.exe	131
PID 3512 wrote to memory of 4280	3512	cmd.exe	133
PID 3512 wrote to memory of 4280	3512	cmd.exe	133
PID 3512 wrote to memory of 4740	3512	cmd.exe	138
PID 3512 wrote to memory of 4740	3512	cmd.exe	138
PID 4740 wrote to memory of 4516	4740	conhost.exe	140
PID 4740 wrote to memory of 4516	4740	conhost.exe	140
PID 4516 wrote to memory of 3028	4516	cmd.exe	142
PID 4516 wrote to memory of 3028	4516	cmd.exe	142
PID 4516 wrote to memory of 880	4516	cmd.exe	144
PID 4516 wrote to memory of 880	4516	cmd.exe	144
PID 880 wrote to memory of 1072	880	conhost.exe	146
PID 880 wrote to memory of 1072	880	conhost.exe	146
PID 1072 wrote to memory of 4748	1072	cmd.exe	148
PID 1072 wrote to memory of 4748	1072	cmd.exe	148
PID 1072 wrote to memory of 5068	1072	cmd.exe	150
PID 1072 wrote to memory of 5068	1072	cmd.exe	150
PID 5068 wrote to memory of 3596	5068	conhost.exe	152
PID 5068 wrote to memory of 3596	5068	conhost.exe	152
PID 3596 wrote to memory of 4396	3596	cmd.exe	154
PID 3596 wrote to memory of 4396	3596	cmd.exe	154
PID 3596 wrote to memory of 3124	3596	cmd.exe	156
PID 3596 wrote to memory of 3124	3596	cmd.exe	156
PID 3124 wrote to memory of 4992	3124	conhost.exe	158
PID 3124 wrote to memory of 4992	3124	conhost.exe	158
PID 4992 wrote to memory of 4244	4992	cmd.exe	160
PID 4992 wrote to memory of 4244	4992	cmd.exe	160
PID 4992 wrote to memory of 2044	4992	cmd.exe	162
PID 4992 wrote to memory of 2044	4992	cmd.exe	162
PID 2044 wrote to memory of 2000	2044	conhost.exe	164
PID 2044 wrote to memory of 2000	2044	conhost.exe	164
PID 2000 wrote to memory of 2608	2000	cmd.exe	166
PID 2000 wrote to memory of 2608	2000	cmd.exe	166
PID 2000 wrote to memory of 4924	2000	cmd.exe	168
PID 2000 wrote to memory of 4924	2000	cmd.exe	168
PID 4924 wrote to memory of 2340	4924	conhost.exe	170
PID 4924 wrote to memory of 2340	4924	conhost.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb96078c8b3ca7a1beade1aa6ea55dd9ed0b36812cc5b70cdd0a24ebf2573745.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
    - - C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4876
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2964
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQtyVABn1C.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4280
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ay5NT8uJA6.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3028
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9Z120WfzwF.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4748
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4396
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4244
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2608
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat"
        20⤵
        
        PID:2340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3440
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat"
        22⤵
        
        PID:2760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:880
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"
        24⤵
        
        PID:5004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1868
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat"
        26⤵
        
        PID:4844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2764
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewVMycoP0v.bat"
        28⤵
        
        PID:3864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4276
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OS3CX563UF.bat"
        30⤵
        
        PID:3576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:3060
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat"
        32⤵
        
        PID:2260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:5112
        
        C:\Users\Admin\conhost.exe
        
        "C:\Users\Admin\conhost.exe"
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
400B

MD5
0b107ff334107284a39c3fbc41e10a4a

SHA1
055f3e3608548db76f35f496c041b6cce03bba96

SHA256
47e357e6d606a9d9d14bfbcff59500017f3250a25942daeb56b747a2b573e4ef

SHA512
426e0121a093bfeaaca020f26b962c8e4a4280a5a7f014312ce955034a65f0af1a58985078ecce36a314d80989166bdf38984d24cfe23534f27fa6c2751be10b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat

Filesize
191B

MD5
25d67c1615383e59847b0ce3400be5e3

SHA1
977acb9ef6d89954ad0246c9ed718e02cd6eec3c

SHA256
e83e0f1c00aa1a5c07ca24077e70764e76f36ae49e776169604fdc490b92e4d2

SHA512
0edf56e1e0e2222dfb51ef1785c22ce44e55840e362525ba75d330eca8c7ac024ef9d44c489b6def357a34d3d0e805c520e2ca73ed38339b98cc19c7375f4354

Download Submit
C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat

Filesize
191B

MD5
96d4743d71ad29b40d825839c4f2634b

SHA1
b472e04dd8b9017d1a48670824d0199b14febc1b

SHA256
6f2866e733b4835f12b6bf23c1652b544a024f7b2116e7d5aabcc92fa4db9aa3

SHA512
95ec971e30c5a4b1f280c45c5d5edb7f171499336a7cb6a2a79ecd4ce8045dc7a55e7b8f9307218a70b29fca6ec1538e0979d799a39d7b5647032c8d5f5c46d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\9Z120WfzwF.bat

Filesize
191B

MD5
6fdbaabe7877dc871bbedddefb5ec595

SHA1
61d11455350b187f9b5450e3cd8396fb759124fd

SHA256
acfbff031cfa11e49d1a55682e5e47f1ce6ca6430414dd0e14db204bfca3bbf0

SHA512
fda25597a7e0769ec73062037ea5676eb1708b569fe33ad388747fe3fb1c27a337cc4770e7de2d691e6c8dfc622ca4c13b30874db3182d0846679b5f3717aef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AQtyVABn1C.bat

Filesize
191B

MD5
16dc7a6cc1f27f1574835ba606e77758

SHA1
1338692267daf7770af64a1f6f0d15f952447f6c

SHA256
a3ceaca76287f5a00232b8e837fc8975dfe16974b1c5ac30cb5dab4bda9bce03

SHA512
63357c2353377ef10b82d0798a749a68b8047bc6be773d47e0197fc0c6830b3dff774239e6cb62cae73b3ce615ddc4a24fe7913e5098197bf7ee575c9e205a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat

Filesize
191B

MD5
df83812c59e95451a9f76fc834e42fe1

SHA1
c1f648966d7d6e75d753c22476b9308e3ff0fbab

SHA256
aa083b7c99ef603eb573118ca1388987332f736ca7c85f19a73fe61a26e09ea8

SHA512
4cb6fdc5b34092154eb97dc729202a9eb65e47eb7125b152cd2ece2042e36dac5ddf478f646c31d9433e8650a1af28fb0977d0213091fae4415f61595b0f9047

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat

Filesize
191B

MD5
41005159ba892e7c97d8967e3a975183

SHA1
558bec9e01dcc50d7bc353e6af736c82383aa310

SHA256
96160abd7e21b4ab2fe065756b99ecea62771f277be917f994b6db8768db5be6

SHA512
832c5a1c66108492a50b6ef0d25d644b3d20d232ccf6746db20a5bc4cd6cb0e3b5781c90d77a326b3c23d154909cb4c8974c437d731989f33186adeac3e82863

Download Submit
C:\Users\Admin\AppData\Local\Temp\OS3CX563UF.bat

Filesize
191B

MD5
d08b24cfc1da545670e16c2e3e5ff1cf

SHA1
f350029b0c5529edeea24dcaa884b745daefd484

SHA256
00df2ab680bed16a7a7c33b5031da9075d72db46d4195b20d80b64422d1bab30

SHA512
7e2df4fc583ed5224e7595293f0a2234d784b95b544d8679bca02cc66de04d4305be91827cd9a53842af89300175665f534f9ec1a7800ea807978c4f5a556507

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat

Filesize
191B

MD5
d23194eaaec3aa064785b42d8d22bc3a

SHA1
0f6f94746c816ab6ddad48c0309c1870a66207a5

SHA256
6c87974d7b670efdc8b76661443ffb7212c91d583a94eb63bb6113003f31d6a5

SHA512
43545eca08eb9639bd8e6bbb7c05964398c53a2855484f23fc56f68ecb33ac018a82923939e0bc6beeae6f506724c697b43240b372c1b45ecac26af25940e41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ia2f5dpl.ek5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ay5NT8uJA6.bat

Filesize
191B

MD5
598ef240bd9dd4cf5bea8054c272cfa3

SHA1
a69c51cafb8e52d1a3c3d999eb625a17f9703249

SHA256
39a0ee79e0822c53e0296d080aedb4421b5e95a9d349c68b98c0c4f98fadd9ab

SHA512
b9cd464052711473e9203353c4eeced511f342ff9d258e2ba38efd1b3c5933b6a439bb3dacbba36d7f6a33470e57b44b6172cbc82ddbc1c599a339abce9e940f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat

Filesize
191B

MD5
6d7f1fe7ce44841c43bf85251fce2bb8

SHA1
093f26821a6c6de99c12b8f43192dc0496c2d5b4

SHA256
b1d16d8768e8e7d72b40a9561445f695235765b9f11e386e01fe68a0cb22836f

SHA512
55020edc532b39345288acee66e9418a1ec8fefc1d877453f29dac33db52769529b5222f76bb5238176a62822ff709c4e2a89aafaa25d5ef39d27f31027a60e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat

Filesize
191B

MD5
9c93de4213a47523b30ee8e21c05afc0

SHA1
abd21e42bf0cc40112b15bf3ace25963f7447685

SHA256
6dc68c3b1a2d4097d4fb0a9ae997970e1fefb6337ff9b0e0fbf9b93a4b1107de

SHA512
1aab251ad152d10a25c70726e3248f29773204f494d195da2c97cc17f6afbbf7a45a05eb8ffa23f9fcdf489862d1e76eeb5ebe85f8b8329f147902de4a639f11

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewVMycoP0v.bat

Filesize
191B

MD5
36dc0bd6c087a561c24890673d349216

SHA1
3508cadf5d0494195da51c81e4776c3985743fad

SHA256
0d8a632fc057d7d94b17ead7013d99ac1efd9ada0d1c3efaf190b1dba09a47a6

SHA512
ac5ba5a8b53e604d6546a7517d654f4901ad00f7ef453d31d82fa074fef0ba1a252ee32cdb735db8b3cce43e6a7a6668b58588a7b587515f2a8140fc37fa9c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\ktiZWDSHsI.bat

Filesize
191B

MD5
8d4653b5db087867dd7f86d2f4f032fb

SHA1
eb8a0b229d72f9ae0d8bf5112cc6142fe3d55644

SHA256
388e8015927b688835d24cff3ecfaba4d6d047648de4e9c68fb58029d7767b52

SHA512
752194a09f9da7609f900291064c6fe8ea53e9f242ec4a9a4f3eddea172771f0428c05873c6957940e38b53508747483f6886ccf992080df3c5d0c55820e5e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat

Filesize
191B

MD5
39f2ba2c6ba96c472e47146300de6243

SHA1
e84ba26b92ad9e6c5f365dc762bf5f74b630da2e

SHA256
11db8ef0fdc892c35b6362e128be98385aa61bd8d6c8c0cbc3496e6239c1b1ab

SHA512
ad214a94f017ccb58fd8d7409ad0924bf2a10325ba63244064f731a317799318abecde05549d8512662169217c35c8bce411bac9a29b86ca13f55233d0030b0d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/212-14-0x0000000002440000-0x0000000002452000-memory.dmp

Filesize
72KB

Download
memory/212-17-0x0000000002630000-0x000000000263C000-memory.dmp

Filesize
48KB

Download
memory/212-15-0x0000000002620000-0x000000000262C000-memory.dmp

Filesize
48KB

Download
memory/212-13-0x00000000001C0000-0x00000000002D0000-memory.dmp

Filesize
1.1MB

Download
memory/212-16-0x0000000002610000-0x000000000261C000-memory.dmp

Filesize
48KB

Download
memory/212-12-0x00007FFB28913000-0x00007FFB28915000-memory.dmp

Filesize
8KB

Download
memory/500-60-0x000002288E2D0000-0x000002288E2F2000-memory.dmp

Filesize
136KB

Download
memory/1856-198-0x000000001CA70000-0x000000001CC19000-memory.dmp

Filesize
1.7MB

Download
memory/1856-197-0x000000001C9C0000-0x000000001CA61000-memory.dmp

Filesize
644KB

Download
memory/1980-172-0x000000001C290000-0x000000001C331000-memory.dmp

Filesize
644KB

Download
memory/1980-173-0x000000001C340000-0x000000001C4E9000-memory.dmp

Filesize
1.7MB

Download
memory/2284-206-0x000000001C530000-0x000000001C6D9000-memory.dmp

Filesize
1.7MB

Download
memory/3372-212-0x000000001C470000-0x000000001C619000-memory.dmp

Filesize
1.7MB

Download
memory/3548-176-0x00000000014E0000-0x00000000014F2000-memory.dmp

Filesize
72KB

Download
memory/3548-182-0x000000001C6F0000-0x000000001C899000-memory.dmp

Filesize
1.7MB

Download
memory/3548-181-0x000000001C630000-0x000000001C6D1000-memory.dmp

Filesize
644KB

Download
memory/3636-190-0x000000001C6F0000-0x000000001C899000-memory.dmp

Filesize
1.7MB

Download
memory/3636-189-0x000000001B8C0000-0x000000001B961000-memory.dmp

Filesize
644KB

Download
memory/3748-120-0x0000000002480000-0x0000000002492000-memory.dmp

Filesize
72KB

Download
memory/3748-126-0x000000001BEB0000-0x000000001C059000-memory.dmp

Filesize
1.7MB

Download
memory/3748-125-0x000000001BE00000-0x000000001BEA1000-memory.dmp

Filesize
644KB

Download
memory/4740-129-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/4876-101-0x0000000001740000-0x0000000001752000-memory.dmp

Filesize
72KB

Download
memory/4876-116-0x000000001C9E0000-0x000000001CB4A000-memory.dmp

Filesize
1.4MB

Download
memory/4924-161-0x0000000002870000-0x0000000002882000-memory.dmp

Filesize
72KB

Download
memory/5068-142-0x0000000000AD0000-0x0000000000AE2000-memory.dmp

Filesize
72KB

Download