dcrat | 39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0

Analysis

max time kernel
145s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe
Size

1.3MB
MD5

8ffa5470289cd1bc91c354cfa7c5d444
SHA1

be1f97c326e6d933a41b43cd936347d52a905ef8
SHA256

39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0
SHA512

dcd9c052713708ff77f2b050722c279eb49e9e9db3e0dee27e5ae9f6ee993ef07fb5fdc51a1c8e90ca9514b89cad0f66f25fd307e652ff5b832c4957a37753de
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2612	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2612	schtasks.exe	35

DCRat payload 12 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000019284-9.dat	dcrat
behavioral1/memory/2840-13-0x0000000001230000-0x0000000001340000-memory.dmp	dcrat
behavioral1/memory/1028-41-0x0000000000F80000-0x0000000001090000-memory.dmp	dcrat
behavioral1/memory/1904-131-0x00000000002D0000-0x00000000003E0000-memory.dmp	dcrat
behavioral1/memory/1740-192-0x0000000000350000-0x0000000000460000-memory.dmp	dcrat
behavioral1/memory/2060-252-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat
behavioral1/memory/1848-313-0x0000000000E20000-0x0000000000F30000-memory.dmp	dcrat
behavioral1/memory/832-374-0x0000000000FC0000-0x00000000010D0000-memory.dmp	dcrat
behavioral1/memory/1944-434-0x00000000000E0000-0x00000000001F0000-memory.dmp	dcrat
behavioral1/memory/1348-494-0x0000000000F30000-0x0000000001040000-memory.dmp	dcrat
behavioral1/memory/2260-554-0x0000000001070000-0x0000000001180000-memory.dmp	dcrat
behavioral1/memory/536-614-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2896	powershell.exe
1400	powershell.exe
356	powershell.exe
2512	powershell.exe
740	powershell.exe
536	powershell.exe
2900	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2840	DllCommonsvc.exe
1028	audiodg.exe
1904	audiodg.exe
1740	audiodg.exe
2060	audiodg.exe
1848	audiodg.exe
832	audiodg.exe
1944	audiodg.exe
1348	audiodg.exe
2260	audiodg.exe
536	audiodg.exe
2792	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
2704	cmd.exe
2704	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\Downloaded Program Files\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Videos\WmiPrvSE.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\Videos\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Videos\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\de-DE\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\f3b6ecef712a24	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2372	schtasks.exe
1396	schtasks.exe
1532	schtasks.exe
1508	schtasks.exe
2720	schtasks.exe
2980	schtasks.exe
2428	schtasks.exe
2476	schtasks.exe
1292	schtasks.exe
2820	schtasks.exe
2108	schtasks.exe
2128	schtasks.exe
376	schtasks.exe
1096	schtasks.exe
896	schtasks.exe
1480	schtasks.exe
2944	schtasks.exe
2168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2840	DllCommonsvc.exe
536	powershell.exe
2512	powershell.exe
2896	powershell.exe
740	powershell.exe
2900	powershell.exe
1400	powershell.exe
356	powershell.exe
1028	audiodg.exe
1904	audiodg.exe
1740	audiodg.exe
2060	audiodg.exe
1848	audiodg.exe
832	audiodg.exe
1944	audiodg.exe
1348	audiodg.exe
2260	audiodg.exe
536	audiodg.exe
2792	audiodg.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	DllCommonsvc.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	356	powershell.exe
Token: SeDebugPrivilege	1028	audiodg.exe
Token: SeDebugPrivilege	1904	audiodg.exe
Token: SeDebugPrivilege	1740	audiodg.exe
Token: SeDebugPrivilege	2060	audiodg.exe
Token: SeDebugPrivilege	1848	audiodg.exe
Token: SeDebugPrivilege	832	audiodg.exe
Token: SeDebugPrivilege	1944	audiodg.exe
Token: SeDebugPrivilege	1348	audiodg.exe
Token: SeDebugPrivilege	2260	audiodg.exe
Token: SeDebugPrivilege	536	audiodg.exe
Token: SeDebugPrivilege	2792	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2888	2648	JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe	31
PID 2648 wrote to memory of 2888	2648	JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe	31
PID 2648 wrote to memory of 2888	2648	JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe	31
PID 2648 wrote to memory of 2888	2648	JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe	31
PID 2888 wrote to memory of 2704	2888	WScript.exe	32
PID 2888 wrote to memory of 2704	2888	WScript.exe	32
PID 2888 wrote to memory of 2704	2888	WScript.exe	32
PID 2888 wrote to memory of 2704	2888	WScript.exe	32
PID 2704 wrote to memory of 2840	2704	cmd.exe	34
PID 2704 wrote to memory of 2840	2704	cmd.exe	34
PID 2704 wrote to memory of 2840	2704	cmd.exe	34
PID 2704 wrote to memory of 2840	2704	cmd.exe	34
PID 2840 wrote to memory of 740	2840	DllCommonsvc.exe	54
PID 2840 wrote to memory of 740	2840	DllCommonsvc.exe	54
PID 2840 wrote to memory of 740	2840	DllCommonsvc.exe	54
PID 2840 wrote to memory of 536	2840	DllCommonsvc.exe	55
PID 2840 wrote to memory of 536	2840	DllCommonsvc.exe	55
PID 2840 wrote to memory of 536	2840	DllCommonsvc.exe	55
PID 2840 wrote to memory of 2512	2840	DllCommonsvc.exe	56
PID 2840 wrote to memory of 2512	2840	DllCommonsvc.exe	56
PID 2840 wrote to memory of 2512	2840	DllCommonsvc.exe	56
PID 2840 wrote to memory of 356	2840	DllCommonsvc.exe	57
PID 2840 wrote to memory of 356	2840	DllCommonsvc.exe	57
PID 2840 wrote to memory of 356	2840	DllCommonsvc.exe	57
PID 2840 wrote to memory of 1400	2840	DllCommonsvc.exe	59
PID 2840 wrote to memory of 1400	2840	DllCommonsvc.exe	59
PID 2840 wrote to memory of 1400	2840	DllCommonsvc.exe	59
PID 2840 wrote to memory of 2896	2840	DllCommonsvc.exe	61
PID 2840 wrote to memory of 2896	2840	DllCommonsvc.exe	61
PID 2840 wrote to memory of 2896	2840	DllCommonsvc.exe	61
PID 2840 wrote to memory of 2900	2840	DllCommonsvc.exe	62
PID 2840 wrote to memory of 2900	2840	DllCommonsvc.exe	62
PID 2840 wrote to memory of 2900	2840	DllCommonsvc.exe	62
PID 2840 wrote to memory of 1028	2840	DllCommonsvc.exe	68
PID 2840 wrote to memory of 1028	2840	DllCommonsvc.exe	68
PID 2840 wrote to memory of 1028	2840	DllCommonsvc.exe	68
PID 1028 wrote to memory of 2544	1028	audiodg.exe	69
PID 1028 wrote to memory of 2544	1028	audiodg.exe	69
PID 1028 wrote to memory of 2544	1028	audiodg.exe	69
PID 2544 wrote to memory of 1888	2544	cmd.exe	71
PID 2544 wrote to memory of 1888	2544	cmd.exe	71
PID 2544 wrote to memory of 1888	2544	cmd.exe	71
PID 2544 wrote to memory of 1904	2544	cmd.exe	72
PID 2544 wrote to memory of 1904	2544	cmd.exe	72
PID 2544 wrote to memory of 1904	2544	cmd.exe	72
PID 1904 wrote to memory of 2912	1904	audiodg.exe	73
PID 1904 wrote to memory of 2912	1904	audiodg.exe	73
PID 1904 wrote to memory of 2912	1904	audiodg.exe	73
PID 2912 wrote to memory of 2824	2912	cmd.exe	75
PID 2912 wrote to memory of 2824	2912	cmd.exe	75
PID 2912 wrote to memory of 2824	2912	cmd.exe	75
PID 2912 wrote to memory of 1740	2912	cmd.exe	76
PID 2912 wrote to memory of 1740	2912	cmd.exe	76
PID 2912 wrote to memory of 1740	2912	cmd.exe	76
PID 1740 wrote to memory of 1452	1740	audiodg.exe	77
PID 1740 wrote to memory of 1452	1740	audiodg.exe	77
PID 1740 wrote to memory of 1452	1740	audiodg.exe	77
PID 1452 wrote to memory of 2200	1452	cmd.exe	79
PID 1452 wrote to memory of 2200	1452	cmd.exe	79
PID 1452 wrote to memory of 2200	1452	cmd.exe	79
PID 1452 wrote to memory of 2060	1452	cmd.exe	80
PID 1452 wrote to memory of 2060	1452	cmd.exe	80
PID 1452 wrote to memory of 2060	1452	cmd.exe	80
PID 2060 wrote to memory of 2644	2060	audiodg.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39bfac67e360cc1865c2253e39e40956357e8c932acc3677952816748be8cef0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Videos\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1888
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2824
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2200
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat"
        12⤵
        
        PID:2644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2528
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat"
        14⤵
        
        PID:2560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2860
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat"
        16⤵
        
        PID:2516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1596
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat"
        18⤵
        
        PID:2568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1728
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat"
        20⤵
        
        PID:1992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1116
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\23CLvB8Ots.bat"
        22⤵
        
        PID:2148
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:996
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat"
        24⤵
        
        PID:2800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2436
        
        C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\NetworkService\Videos\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Videos\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\NetworkService\Videos\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\Downloaded Program Files\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\Downloaded Program Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d8a081b9d4a917d14646ee1c2ae677

SHA1
2ad7c176b1fa5c16af779c9d1dca4944124fa1dc

SHA256
241fe6897d8284fa13f098db7f3a0a02689bfd305223cac22fea008382c13f4d

SHA512
9f14d8a8c865851fbde7af87429ee9504075734198d10b2e290442611163dd6c6bdc1e61d03bd67b3c77006570aebfe6634aaf18c533f3ddcfaeb591984cb0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d56fc5c068c6bc3a464729a28dbde41

SHA1
bd0455899d33c4d2540ed2594d5869d3da388a01

SHA256
6eaa8b6ccf42e7d68301c05c1264fc8814453aec44f99761fb3081bb65c8f151

SHA512
d1241937ed90215894df74ef122918327957fd7c7661988bcdc12c678c76f8eb43b783eba5c6d743c30027b8434ca776a7041ebd628ce3c2fa725b3b13ba87d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac1d360deb0701c75cdc825083bb999

SHA1
bd6f52f47fab577dbd6e85c0b1d281b6a90887b2

SHA256
eca156d07480db610ceb3ff43b349e48e70f4700c7591cbd892950f9f6263e82

SHA512
93aea94c492d3f7290ec552129148a9943053dd375dc37f232ca1c7d769536d92ddea97ecf57b8690ab113cde3dc600c8c7450eb7f43c1a89c88db0010a43562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0807e205706910d5a06832f5d37d8244

SHA1
faf882bbf0addf322090cc9c2d015718230b6816

SHA256
cfbe0ac73d0e1f61a7dc88aa046d1a08aacbbbdbcf2e4892e774610a90685d25

SHA512
7e7181f3cbb194ace5635fe116af145b70d806375d6203bdda74592f66fe090fcc9b73ed4bb8a7a8013e261e6214451f6833a8be2f4a0baa472ae62fe0730aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e830016112039f9acea3dbfc68d698d9

SHA1
f1147e3dfb058318579b4d0664f7b50548bc7861

SHA256
209a08daea41a480869b7ababe11e54188a375d7d492df424ddeead23317e71b

SHA512
a13eaec9c916bf9558b2728dba6a3f548b84d699ac6cd64de40f09bf41f2b36d1898fcfbf71a7261b77950f3b18b12650d6c92370517f342df309de6f3ddb993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3078d440901734ef414832d8a48f4649

SHA1
07097c68e5f7a8f6c1d34f6f7af7a64e0e445294

SHA256
8856fe5c5f917d64d8746cb59679499c3fa161663d07683912250f8a3c493c8a

SHA512
54f082ebd3bef907ca53284ed353d1a9f0cfaf0e1f091dfd9de818af00d0a832ee420926f60baef1b5a0c747c4582b999a18746220a65110862e2f7a8d19e77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25b8fcc1e11fb435362f65efd2cfde7a

SHA1
f8feb1e31b8abb06934011a3cc9678b6bcb9fbd8

SHA256
2c790a0b016e5a9a4954b72488a493b639d70d2ef58b0bf16b5b002be76bd712

SHA512
6bee48f717f1ea12f1b5fa2174685197e6ef84b96965798464fbfca66e7ebd031fd49079ccc0cfedacee9a0694d29b23cc05758d08408950c07c985e5ca8a091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cb54c1b9df380baaa712c1d33728e99

SHA1
936e5d824bbe059a454bb834b9157ffa859ff095

SHA256
4725fd93201ff62a31fec3aa6f3e57dac2ca68e9e40719403ac937fd50ffc718

SHA512
f588aa39bc38fa2f3f01b72492345e1e30427fa3952be9d7807be2f9c26b1f99a33f89f6088668920e69a7d701315f97ccf2cf30e1aa646d3325de1f34971698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac890b14a5049db66886204a7b78de36

SHA1
662f92ad66f73220ae547bfe4de53aada2fafbf4

SHA256
48c02ca53379e213c17c70d66ac8ae64b007cb7fed85bb4b90eb354e63f9d825

SHA512
12929c986a97740b389a3afd623b4f23a27f676060ab6696fb51f31ae08cb00e4c1abdf6acd25e61ed673be28440d2696242b4d96e3d8e515cd47295b3651e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\23CLvB8Ots.bat

Filesize
239B

MD5
6b20e399e560d0a42a68a3fd873babfa

SHA1
96c1eda33f1f7e069543ba835ad4e2b37a3abd4b

SHA256
2b772afc0847663067dc343241f6bcae4bda073c849a8a2c65610c1364c39f2f

SHA512
87529b150551f538467044ae341bedba5486d63442b12f9daf6ed455f07447fb774cced2dd6dc666bdeccb5c8337e89a682419889ff48bd60a1c3af8c9a29ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab13A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat

Filesize
239B

MD5
33c6c476b7d128a82ad9ffc67ab2184b

SHA1
a4ff96c55411dcd1fff08336f5eee60940a23141

SHA256
552e918f45a0248134e0b9e81ba10071b0e57df4ada08c8ee504a0a72a0c5e23

SHA512
6c4f9b8901bf8c046c94a61046a54542821b98b08bef83730b7ddf423da54f5681d73799a451c3b5c09536edff171eddfeb58b9cf18f5ea321121f984039a3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat

Filesize
239B

MD5
b3404006771e3a5174454871915c3e30

SHA1
233b28584de530757c6713720ce2d90ba7167c44

SHA256
e1d3d6fd90cd11ef6b79894e3ea5114f48b1db8fa4b169a6bef7f4c41258b697

SHA512
40ece4078e52a8bdca01fdcc4b6aa3ed4b027973af303da7331e5e77ca111e63003aefbd5c1013e72b7e1c190951c16928d4ec4dcfdb312c8bf4ece9a681005b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat

Filesize
239B

MD5
086aca402ce6efb6236d470b9f6f046b

SHA1
75c8ea27a686837fe6e9cbd9b2e3dc1ed1f05c91

SHA256
9baf049de4159058e1a1ec04028a6774b55f9e3e0c4d027b8f9dbcc6cb46e7cd

SHA512
85e0a17abefa466684440b5873a67e79d750211b82af2b9de8c808b5108ca88e1490b446f5061cc9ae3580d73e4d8ed63ca6096605798f4c56e7b0a177e660cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat

Filesize
239B

MD5
53a679ac5e82d94435ffdddf229e4f4b

SHA1
43e30f8a77d79ffba62cc05e25f32fc6d61606f3

SHA256
e06670a846dd5f9bf818dfd93c57b5e3602e908c899f261ec478ae869933b210

SHA512
249efb78bc9d0fe3540a5478d9880e9621381c41b56a2041160cd8f09ec5b07f5a1304495de05bd0b58359d1e66617c37c8ef8b5652ae1aaace2daa3f8ee212c

Download Submit
C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat

Filesize
239B

MD5
3422358d5f8d4e683852dd39d7d3fbf6

SHA1
0ee150153e499e0d0f2f7dbb2c11031e78a0729f

SHA256
0f4708e6c74702d918cc1cfaf63f731911b88f618349d57362df708b51d7a562

SHA512
827e622df5a78d48c97c9d0a04f55b21f84e3fad16787e6be653ede49dbb5354efba62fa2565fc18ca2268e1457d5d06341b9eca49ccc982149c439d79fc95bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13B5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat

Filesize
239B

MD5
c16195825251f5254a5294bd7bd402a9

SHA1
85907aa78b341305c3bab97c8096c906cf648b05

SHA256
d32a6e39a54bfacbd727f176cd7e720233584db31c174d108e1988b7efbd988b

SHA512
5b394afd399f0aaace793662ba8413f1c91c28e152b638d3165b2ba07ca77c9f89327e67b916f54543f26d8c29c1bb83c46b043c376f4279ad4229b965fa199f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat

Filesize
239B

MD5
a6731de6064e8d04b6585d5ad418d786

SHA1
fecea171869b7951ee746fada7ae9354c0b97bb5

SHA256
be80e8ab6372b32913e02e6acee897001ef1ea7bd116a8bf4f61e406a3fedb1e

SHA512
ad8bc0eb49ea6d16965643db1f63ab8438bbf23571250bd2c996b33382555aa7db37c5d69a8510e7e8d59de10ffd45827752f82f9ee19c8dd00e3fb6439517fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat

Filesize
239B

MD5
4cf9f9c5648053e49b2810fb3688c1f7

SHA1
8cfc8aa064e24b76f62106fa6f327d6367eb92ce

SHA256
11c906e331b4592f7b8f7e7bac7ccbf76d4c1661740c79dbe8ee5fc09d98ae7f

SHA512
e332ab2f821f9083f900e86246d817710266d1cb2721e5b15ad930024b831311659b17c011238172ef1f5798fdf43c35132157a3b495cc5ac88c158123d71361

Download Submit
C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat

Filesize
239B

MD5
86ad416108461a2ee85f8ee2f2ed48e5

SHA1
54121a88610e8b172ebdca9d9754fc0cde7a1935

SHA256
9139fadb6f56b318fc5455c040bb36796412eff96575187baeb7e98e77764408

SHA512
bd9d3a5ee33d4845cad13af8300ad08edc84232be670a0d36d0839e3834a6aa78c607007154d8c8de004af42b4d728d74216e959717d89cca214ceee68b15d5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
92bc323c308d265110a23d943193fd7d

SHA1
38d74178c108739db8fe8f9a09a857e49ab16fd6

SHA256
7f8421bcf51f46773cbf61a4381a19268fee38ecc98eaf598f485c9d93326188

SHA512
52d68e346608a4e87d3956419dadf5716124a7ef590c18f5bfcceb35201754ae18547b41fe066c65dd761f68ec50b34a17c048557086cfaf499f384dcdc6f619

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/536-42-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/536-43-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/536-614-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/832-374-0x0000000000FC0000-0x00000000010D0000-memory.dmp

Filesize
1.1MB

Download
memory/1028-41-0x0000000000F80000-0x0000000001090000-memory.dmp

Filesize
1.1MB

Download
memory/1348-494-0x0000000000F30000-0x0000000001040000-memory.dmp

Filesize
1.1MB

Download
memory/1740-192-0x0000000000350000-0x0000000000460000-memory.dmp

Filesize
1.1MB

Download
memory/1848-313-0x0000000000E20000-0x0000000000F30000-memory.dmp

Filesize
1.1MB

Download
memory/1848-314-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1904-132-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1904-131-0x00000000002D0000-0x00000000003E0000-memory.dmp

Filesize
1.1MB

Download
memory/1944-434-0x00000000000E0000-0x00000000001F0000-memory.dmp

Filesize
1.1MB

Download
memory/2060-253-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/2060-252-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/2260-554-0x0000000001070000-0x0000000001180000-memory.dmp

Filesize
1.1MB

Download
memory/2840-17-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2840-16-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/2840-15-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2840-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2840-13-0x0000000001230000-0x0000000001340000-memory.dmp

Filesize
1.1MB

Download