dcrat | cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe
Size

1.3MB
MD5

d5d7324b6f9b92da9d2b74886b17831e
SHA1

bf6cd2aac365dc00e7f4943d2c88670d580b025b
SHA256

cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e
SHA512

a848fa719d2da943dc0a8f5013fa00bbb5374fa0c1c28594dd18c36375918a3a2768b729a55f7fbbcc7841ad1dd680412dfa75d2d7363d929b8267ed8d2661ba
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1092	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	1092	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b6a-10.dat	dcrat
behavioral2/memory/3500-13-0x0000000000DF0000-0x0000000000F00000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
816	powershell.exe
4456	powershell.exe
4836	powershell.exe
2312	powershell.exe
2044	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 16 IoCs

pid	Process
3500	DllCommonsvc.exe
4964	sysmon.exe
3032	sysmon.exe
3652	sysmon.exe
4824	sysmon.exe
752	sysmon.exe
2768	sysmon.exe
1064	sysmon.exe
4760	sysmon.exe
2944	sysmon.exe
4748	sysmon.exe
3976	sysmon.exe
1676	sysmon.exe
1964	sysmon.exe
4964	sysmon.exe
2008	sysmon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
50	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
57	raw.githubusercontent.com
18	raw.githubusercontent.com
25	raw.githubusercontent.com
41	raw.githubusercontent.com
47	raw.githubusercontent.com
59	raw.githubusercontent.com
26	raw.githubusercontent.com
40	raw.githubusercontent.com
58	raw.githubusercontent.com
19	raw.githubusercontent.com
45	raw.githubusercontent.com
56	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WaaS\fontdrvhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	sysmon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5088	schtasks.exe
1456	schtasks.exe
1628	schtasks.exe
1832	schtasks.exe
3032	schtasks.exe
2164	schtasks.exe
4960	schtasks.exe
4388	schtasks.exe
1700	schtasks.exe
3188	schtasks.exe
4912	schtasks.exe
640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3500	DllCommonsvc.exe
4836	powershell.exe
2044	powershell.exe
816	powershell.exe
2312	powershell.exe
4456	powershell.exe
2312	powershell.exe
4836	powershell.exe
2044	powershell.exe
4964	sysmon.exe
816	powershell.exe
4456	powershell.exe
3032	sysmon.exe
3652	sysmon.exe
4824	sysmon.exe
752	sysmon.exe
2768	sysmon.exe
1064	sysmon.exe
4760	sysmon.exe
2944	sysmon.exe
4748	sysmon.exe
3976	sysmon.exe
1676	sysmon.exe
1964	sysmon.exe
4964	sysmon.exe
2008	sysmon.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	DllCommonsvc.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4964	sysmon.exe
Token: SeDebugPrivilege	3032	sysmon.exe
Token: SeDebugPrivilege	3652	sysmon.exe
Token: SeDebugPrivilege	4824	sysmon.exe
Token: SeDebugPrivilege	752	sysmon.exe
Token: SeDebugPrivilege	2768	sysmon.exe
Token: SeDebugPrivilege	1064	sysmon.exe
Token: SeDebugPrivilege	4760	sysmon.exe
Token: SeDebugPrivilege	2944	sysmon.exe
Token: SeDebugPrivilege	4748	sysmon.exe
Token: SeDebugPrivilege	3976	sysmon.exe
Token: SeDebugPrivilege	1676	sysmon.exe
Token: SeDebugPrivilege	1964	sysmon.exe
Token: SeDebugPrivilege	4964	sysmon.exe
Token: SeDebugPrivilege	2008	sysmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1692	4220	JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe	82
PID 4220 wrote to memory of 1692	4220	JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe	82
PID 4220 wrote to memory of 1692	4220	JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe	82
PID 1692 wrote to memory of 2128	1692	WScript.exe	83
PID 1692 wrote to memory of 2128	1692	WScript.exe	83
PID 1692 wrote to memory of 2128	1692	WScript.exe	83
PID 2128 wrote to memory of 3500	2128	cmd.exe	85
PID 2128 wrote to memory of 3500	2128	cmd.exe	85
PID 3500 wrote to memory of 816	3500	DllCommonsvc.exe	99
PID 3500 wrote to memory of 816	3500	DllCommonsvc.exe	99
PID 3500 wrote to memory of 4456	3500	DllCommonsvc.exe	100
PID 3500 wrote to memory of 4456	3500	DllCommonsvc.exe	100
PID 3500 wrote to memory of 4836	3500	DllCommonsvc.exe	101
PID 3500 wrote to memory of 4836	3500	DllCommonsvc.exe	101
PID 3500 wrote to memory of 2312	3500	DllCommonsvc.exe	102
PID 3500 wrote to memory of 2312	3500	DllCommonsvc.exe	102
PID 3500 wrote to memory of 2044	3500	DllCommonsvc.exe	103
PID 3500 wrote to memory of 2044	3500	DllCommonsvc.exe	103
PID 3500 wrote to memory of 4964	3500	DllCommonsvc.exe	109
PID 3500 wrote to memory of 4964	3500	DllCommonsvc.exe	109
PID 4964 wrote to memory of 4300	4964	sysmon.exe	113
PID 4964 wrote to memory of 4300	4964	sysmon.exe	113
PID 4300 wrote to memory of 2508	4300	cmd.exe	115
PID 4300 wrote to memory of 2508	4300	cmd.exe	115
PID 4300 wrote to memory of 3032	4300	cmd.exe	119
PID 4300 wrote to memory of 3032	4300	cmd.exe	119
PID 3032 wrote to memory of 4272	3032	sysmon.exe	120
PID 3032 wrote to memory of 4272	3032	sysmon.exe	120
PID 4272 wrote to memory of 1480	4272	cmd.exe	122
PID 4272 wrote to memory of 1480	4272	cmd.exe	122
PID 4272 wrote to memory of 3652	4272	cmd.exe	123
PID 4272 wrote to memory of 3652	4272	cmd.exe	123
PID 3652 wrote to memory of 3580	3652	sysmon.exe	124
PID 3652 wrote to memory of 3580	3652	sysmon.exe	124
PID 3580 wrote to memory of 5100	3580	cmd.exe	126
PID 3580 wrote to memory of 5100	3580	cmd.exe	126
PID 3580 wrote to memory of 4824	3580	cmd.exe	128
PID 3580 wrote to memory of 4824	3580	cmd.exe	128
PID 4824 wrote to memory of 3660	4824	sysmon.exe	130
PID 4824 wrote to memory of 3660	4824	sysmon.exe	130
PID 3660 wrote to memory of 2260	3660	cmd.exe	132
PID 3660 wrote to memory of 2260	3660	cmd.exe	132
PID 3660 wrote to memory of 752	3660	cmd.exe	133
PID 3660 wrote to memory of 752	3660	cmd.exe	133
PID 752 wrote to memory of 3656	752	sysmon.exe	134
PID 752 wrote to memory of 3656	752	sysmon.exe	134
PID 3656 wrote to memory of 408	3656	cmd.exe	136
PID 3656 wrote to memory of 408	3656	cmd.exe	136
PID 3656 wrote to memory of 2768	3656	cmd.exe	137
PID 3656 wrote to memory of 2768	3656	cmd.exe	137
PID 2768 wrote to memory of 4260	2768	sysmon.exe	138
PID 2768 wrote to memory of 4260	2768	sysmon.exe	138
PID 4260 wrote to memory of 1580	4260	cmd.exe	140
PID 4260 wrote to memory of 1580	4260	cmd.exe	140
PID 4260 wrote to memory of 1064	4260	cmd.exe	141
PID 4260 wrote to memory of 1064	4260	cmd.exe	141
PID 1064 wrote to memory of 1088	1064	sysmon.exe	142
PID 1064 wrote to memory of 1088	1064	sysmon.exe	142
PID 1088 wrote to memory of 468	1088	cmd.exe	144
PID 1088 wrote to memory of 468	1088	cmd.exe	144
PID 1088 wrote to memory of 4760	1088	cmd.exe	145
PID 1088 wrote to memory of 4760	1088	cmd.exe	145
PID 4760 wrote to memory of 4056	4760	sysmon.exe	146
PID 4760 wrote to memory of 4056	4760	sysmon.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cfdfe1745ca438101536b3a10ec6ce3389538455c543481e46f8e2406ebc511e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
    - - C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4964
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2508
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRWwqJyPGw.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1480
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjauxUKpXQ.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5100
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9EGxcg3vT.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2260
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:408
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1580
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRWwqJyPGw.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:468
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat"
        20⤵
        
        PID:4056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1480
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat"
        22⤵
        
        PID:3680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4992
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
        24⤵
        
        PID:2964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3112
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat"
        26⤵
        
        PID:4848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2044
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"
        28⤵
        
        PID:5084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4304
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
        30⤵
        
        PID:216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:4892
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat"
        32⤵
        
        PID:2948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:1708
        
        C:\Users\All Users\sysmon.exe
        
        "C:\Users\All Users\sysmon.exe"
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat

Filesize
194B

MD5
20b152afeeb4a19588e5d3e0b50943e6

SHA1
19d391d3d3e99bf87093f5c5574ff8023cedfbad

SHA256
a6ccbb6572d2d5ff3c6ebbeee0b0854f07b2da82ec9e64a3c0849b6e3b24bac3

SHA512
48fe9f7f133e445f5fb1fcf7e4ae5ac9b64144e6f1e9d1881841ec9089162014f5f0fb505f38a1bde49773e62c1045f732d919fc8e728dfc30f71c182d0aed56

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9EGxcg3vT.bat

Filesize
194B

MD5
6434b914126982ecee3d9c9ad7070993

SHA1
71c0da03093cac310f91a691c5df83f524b19ea9

SHA256
cf8a81ef86fef1873206bccf26dea84020d8687f787f9e08eb49120866b2ca8b

SHA512
4ebdcd9fe88df1b490091ee3d3082284b981491a5a4f11c6f6591701227b63a60e88ec8049d76a7c4963e4e9f580152cdc36ef01b9bd3d9899e5bd31288ec223

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat

Filesize
194B

MD5
7d3da58b0273cc5678a659405fd0d0bb

SHA1
60966778f6ac252d76d643bab5796a5b0666b3ab

SHA256
eddf40899f330e7f4868ff12eefb3b0b8f0e8a0d4436c28905eb71b65c98d634

SHA512
e3fb034e3fccc784cb92ae0f5bbfd8e51e43a6a32478c6675f96b74b8f3b0bceab31ee5bc44fe86106fa23b031eda922484e93bc8d83cf4b376fb7827ad495aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\I1IMKnnpZ2.bat

Filesize
194B

MD5
845eacff42d1b1036fe849af172acfb0

SHA1
eabb72757abb3bd084820670ba9f81ec9346940a

SHA256
d0771ae3b9e417bdc7f1581f971363ba344286d3acfa7a5a60074207908d8682

SHA512
bdfeea14b5cf8330b18c21a7a874d2dcd059cfb1b4140601003418ddd547092e2018833c48ed951fc8fecf158c915c8e47a6948cd5ac0fa0809494bf80061a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat

Filesize
194B

MD5
99cac12df5bb961fe578c1df388e3a48

SHA1
1fa04d27b725f2b6ad7c961ca0820a94382651c3

SHA256
28a6dd1ab49ef293be00c97dee1be74f6ee0ca55045d4ae3a444c65d830609b0

SHA512
608a4ab29fe4523437de4f08cac182b6d148eaddbea88a377db8e107ba1786f0f2afe3b50c99776892628ee990cd26d9a22be53724d5aca9e7b77372d99c9fa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vues2hdh.13g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat

Filesize
194B

MD5
e87b63df678915bf5c1ef21cd28d914c

SHA1
dccaa0c6b6fecdf364dcb7db3a4b0830a58294cf

SHA256
35fb6fd7e32b82994ec19934f87745f3f42f63b95ed14b9b627155c83e9b4f3a

SHA512
d908e4c6f095e99d4117f17c22812480cf40f34fdd545ba4de50e269110058110bc01ac2a3fa97de652708bc1f4419a0c56de53cb2bd1f1cb9a8f806a5941b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat

Filesize
194B

MD5
73631e72b8599a729420f0bc8ae2acb4

SHA1
efa3081030818bf26e6e0b1b523a4d438a6009eb

SHA256
39919431ab86440f43721cfcde190f66f3d36c82e9e22cb227b73f86a325691e

SHA512
3ebfb0c6928f7a28ed598ec3b81bf190e9e49ab6c3858ee1a393d9e90e8b2ce0b140bf1a3e77e8fa742e670ba91233755449ab10facc3ca28bf786661f73e235

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

Filesize
194B

MD5
be2ce1c7e4f04741402a86be9234ae88

SHA1
942ade18a705c9495679036c42f0257bcb76c43d

SHA256
a59838a87b0f1dfedfa29709c5df8d4e4b595f5c11861ec6fb68373dcafa7c02

SHA512
82a1bee76cf8212430f6197dc2cdcab572632ba5c86fa60ea6369de4042ad75be1dcb9a2771464563aba5c8c9b11df56a277ae95a9062827da83a2312910dabc

Download Submit
C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

Filesize
194B

MD5
42f9bc6beb188ea3e139c8325f217d98

SHA1
d149ed1c75aeb4fd889707500ad5a4117b8fcc46

SHA256
469f7afe53b81a2c9e2d3f299083721c6cb0603c2d3800ce2e0ef1410cc8b796

SHA512
8c65be266a2b636c5b5fdde2d184381f1f7b9395f58f27a51551c724da713936aaa33ce052c40eaa00c66d0bc14c5d9504169f6a13a2efa6adc1a90547cf1953

Download Submit
C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat

Filesize
194B

MD5
73ee8fbe010a1a4543f80c3b472e8bbf

SHA1
d1e4fa4d42d3e037ea314967d8455eab6b46797e

SHA256
3924525036d61a79fdc2caf3663a09f31ec02d1fa324fdcbd4a3480d3ba840a7

SHA512
2b15f7dc53980c3ef6e595c5ac11b4317b61f2c78db39af736933bbf1ae9024500eb4131983e4e6139af61a40ad19570fa015b1a8bcdc39c97bc38e2354ae653

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjauxUKpXQ.bat

Filesize
194B

MD5
a9f8a43fb6d44bf794871714f34515c6

SHA1
ceb76f3881df34a01628caa9c83391c8a747ce48

SHA256
a3db5ec2f87e0e1a9bc896f0467a479b7c9b203e31ff351474c5e39cd74ff1c7

SHA512
a4f48343428ef89855dc4678d36fe62c7b05778bcbde052111876f5a3154559b71ab78072c47c8c5e490ac6d28f3a10a9291042731241ce4f6528c913fcf8412

Download Submit
C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat

Filesize
194B

MD5
10ac42783a83dbba963461707e8d588b

SHA1
b554e8901783263645dcc327e9e29f7bb3e4e37b

SHA256
fc44fdb61b6fe643376ff0c6a4d44a35707fc1fa9c9f258bdb4f1f2f18576eb4

SHA512
b58023bd44120b7ab5f8ca996c8ae933d5682950722b312338d3b3b9477b012042e3fcd3273a8c91bf88b8e4b15eac9d054f45e87bfca19895879efe86bf5628

Download Submit
C:\Users\Admin\AppData\Local\Temp\wRWwqJyPGw.bat

Filesize
194B

MD5
a72cd80d57a6482587057abf522b79e5

SHA1
088f86f928c6e997734f49ed9088f82fd469d8f7

SHA256
3fcdbfca4dd1f1fd846e1d8ec03894427971678521ad0ee2124fbcfe4ac73df4

SHA512
97d7c9daac6d77a3b56820cbb1e623f62f73ce49a40f8bdf353a266f157e1fe2785f15704e646032df55d7d6a6f7f8bf329e313a1f125b40f4fb834863a407bc

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1064-135-0x0000000002E40000-0x0000000002E52000-memory.dmp

Filesize
72KB

Download
memory/1964-173-0x0000000002520000-0x0000000002532000-memory.dmp

Filesize
72KB

Download
memory/2044-46-0x000001B0CCB70000-0x000001B0CCB92000-memory.dmp

Filesize
136KB

Download
memory/3500-16-0x0000000002F80000-0x0000000002F8C000-memory.dmp

Filesize
48KB

Download
memory/3500-17-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

Filesize
48KB

Download
memory/3500-15-0x0000000002FA0000-0x0000000002FAC000-memory.dmp

Filesize
48KB

Download
memory/3500-14-0x0000000002F70000-0x0000000002F82000-memory.dmp

Filesize
72KB

Download
memory/3500-13-0x0000000000DF0000-0x0000000000F00000-memory.dmp

Filesize
1.1MB

Download
memory/3500-12-0x00007FFBFAD53000-0x00007FFBFAD55000-memory.dmp

Filesize
8KB

Download
memory/3652-109-0x0000000001310000-0x0000000001322000-memory.dmp

Filesize
72KB

Download
memory/4748-154-0x0000000002CD0000-0x0000000002CE2000-memory.dmp

Filesize
72KB

Download
memory/4824-116-0x0000000002600000-0x0000000002612000-memory.dmp

Filesize
72KB

Download
memory/4964-83-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download