Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 18:29

General

  • Target

    JaffaCakes118_148628a65c9d0b7e3085682e6f6f175930eb292667560b125c9b15eb880fbc74.exe

  • Size

    1.3MB

  • MD5

    2a2f491aa6f9963908916033c9cedd3c

  • SHA1

    fe26fa5085318afe6c8e35924c524906c410b075

  • SHA256

    148628a65c9d0b7e3085682e6f6f175930eb292667560b125c9b15eb880fbc74

  • SHA512

    27fa84df57c93eb04be0de81cf38322b0e454651a07599397441f178837b9112c2e8eadb7db43bf7aa5f557cd293c0a5f610b1da971fc02a1f5855112433cfd4

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_148628a65c9d0b7e3085682e6f6f175930eb292667560b125c9b15eb880fbc74.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_148628a65c9d0b7e3085682e6f6f175930eb292667560b125c9b15eb880fbc74.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\SppExtComObj.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1436
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4856
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4468
          • C:\providercommon\DllCommonsvc.exe
            "C:\providercommon\DllCommonsvc.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2544
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3872
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\sihost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4352
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:952
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\conhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2564
            • C:\Users\Public\Videos\conhost.exe
              "C:\Users\Public\Videos\conhost.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3624
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4432
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  8⤵
                    PID:4368
                  • C:\Users\Public\Videos\conhost.exe
                    "C:\Users\Public\Videos\conhost.exe"
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2628
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat"
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4628
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        10⤵
                          PID:1472
                        • C:\Users\Public\Videos\conhost.exe
                          "C:\Users\Public\Videos\conhost.exe"
                          10⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2848
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HAQQp9H1T4.bat"
                            11⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4464
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              12⤵
                                PID:3000
                              • C:\Users\Public\Videos\conhost.exe
                                "C:\Users\Public\Videos\conhost.exe"
                                12⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2700
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wLA3izB53h.bat"
                                  13⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4428
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    14⤵
                                      PID:3244
                                    • C:\Users\Public\Videos\conhost.exe
                                      "C:\Users\Public\Videos\conhost.exe"
                                      14⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:3352
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
                                        15⤵
                                          PID:812
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:2488
                                            • C:\Users\Public\Videos\conhost.exe
                                              "C:\Users\Public\Videos\conhost.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1732
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat"
                                                17⤵
                                                  PID:1680
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    18⤵
                                                      PID:4100
                                                    • C:\Users\Public\Videos\conhost.exe
                                                      "C:\Users\Public\Videos\conhost.exe"
                                                      18⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1324
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"
                                                        19⤵
                                                          PID:1528
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            20⤵
                                                              PID:388
                                                            • C:\Users\Public\Videos\conhost.exe
                                                              "C:\Users\Public\Videos\conhost.exe"
                                                              20⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4860
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat"
                                                                21⤵
                                                                  PID:2796
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    22⤵
                                                                      PID:4728
                                                                    • C:\Users\Public\Videos\conhost.exe
                                                                      "C:\Users\Public\Videos\conhost.exe"
                                                                      22⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4384
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sT6xLp4JQ8.bat"
                                                                        23⤵
                                                                          PID:3612
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            24⤵
                                                                              PID:4428
                                                                            • C:\Users\Public\Videos\conhost.exe
                                                                              "C:\Users\Public\Videos\conhost.exe"
                                                                              24⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1232
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat"
                                                                                25⤵
                                                                                  PID:3352
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    26⤵
                                                                                      PID:3764
                                                                                    • C:\Users\Public\Videos\conhost.exe
                                                                                      "C:\Users\Public\Videos\conhost.exe"
                                                                                      26⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2412
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
                                                                                        27⤵
                                                                                          PID:5008
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            28⤵
                                                                                              PID:2056
                                                                                            • C:\Users\Public\Videos\conhost.exe
                                                                                              "C:\Users\Public\Videos\conhost.exe"
                                                                                              28⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4376
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\SppExtComObj.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3844
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\SppExtComObj.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5004
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\SppExtComObj.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4388
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\sysmon.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3456
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3972
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3240
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2968
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3712
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:208
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1176
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1508
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2108
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1472
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4600
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3464
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\DllCommonsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2996
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\TAPI\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2072
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2044
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4216
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4456
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2100
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\powershell.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4800
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\powershell.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2436
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\powershell.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4860
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\ssh\sihost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3484
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\ssh\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2832
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4548
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2168
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2772
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2288
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\conhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5004
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Videos\conhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4496
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\conhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4072

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Recovery\WindowsRE\38384e6a620884

                                        Filesize

                                        442B

                                        MD5

                                        1a9adb2096382375c04ded40bd300863

                                        SHA1

                                        1354daf78feac9c4d89650cb5c4f24669276fc95

                                        SHA256

                                        3fe180077cab62a61e09b433fd271f0f7e64d8f58aee8fede8013c5d2c1990f8

                                        SHA512

                                        d890052efde684ebe51414f149075cd0bd667ee93a0cd34b346c6afabbff45420bf1cc178f0cca9db55d02608cc6f3b3bab354f4d254c4d02ec9c09e684db62e

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        7f3c0ae41f0d9ae10a8985a2c327b8fb

                                        SHA1

                                        d58622bf6b5071beacf3b35bb505bde2000983e3

                                        SHA256

                                        519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                        SHA512

                                        8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        77d622bb1a5b250869a3238b9bc1402b

                                        SHA1

                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                        SHA256

                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                        SHA512

                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        2e907f77659a6601fcc408274894da2e

                                        SHA1

                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                        SHA256

                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                        SHA512

                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        d28a889fd956d5cb3accfbaf1143eb6f

                                        SHA1

                                        157ba54b365341f8ff06707d996b3635da8446f7

                                        SHA256

                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                        SHA512

                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        cadef9abd087803c630df65264a6c81c

                                        SHA1

                                        babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                        SHA256

                                        cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                        SHA512

                                        7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        62623d22bd9e037191765d5083ce16a3

                                        SHA1

                                        4a07da6872672f715a4780513d95ed8ddeefd259

                                        SHA256

                                        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                        SHA512

                                        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        83685d101174171875b4a603a6c2a35c

                                        SHA1

                                        37be24f7c4525e17fa18dbd004186be3a9209017

                                        SHA256

                                        0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

                                        SHA512

                                        005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        9bc110200117a3752313ca2acaf8a9e1

                                        SHA1

                                        fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

                                        SHA256

                                        c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

                                        SHA512

                                        1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        4165c906a376e655973cef247b5128f1

                                        SHA1

                                        c6299b6ab8b2db841900de376e9c4d676d61131e

                                        SHA256

                                        fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4

                                        SHA512

                                        15783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        232B

                                        MD5

                                        fdd1f59d140a23011a1ca04749ba5883

                                        SHA1

                                        db0ef3a2a4e2ad7285398fd1f721ae52b6f6a1d2

                                        SHA256

                                        0f3ec1194f8dbddc31a702718a4242e1e57a6542e7662f77885f9eb46911f364

                                        SHA512

                                        8e5ceabcba45b76fba5dabdb4ca28e82b62d95912df153d341d9daec34301aff92d2ce227c22700552493328e27aaf099e4d528ef426899e019517772d136bfe

                                      • C:\Users\Admin\AppData\Local\Temp\HAQQp9H1T4.bat

                                        Filesize

                                        199B

                                        MD5

                                        fd4b4ab6f314b40330a8bfb262654c17

                                        SHA1

                                        882a7fa12ea3dfa840ccdd31d7aa3267b17a8a8f

                                        SHA256

                                        97f537fb4e3c056c839fc2001c114ec4d1ba4d44e5f5b67751fb8a4c2b7eb05b

                                        SHA512

                                        4cb8f5cb86f8eed00754451120b4c024a335d574af2630aabb06fc19049bfe0e86c11b3d306c7ea1000d2e1229f9a49df18b1e4fe7b201fa6acebb729897d72c

                                      • C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat

                                        Filesize

                                        199B

                                        MD5

                                        43f1cb3f1c10159aad344e4a607453cc

                                        SHA1

                                        3ea9f6a5a851672fa5ff04e12dbb3155aad2a113

                                        SHA256

                                        e6a9f10cc4bc0e6837372f84ab560906f5b652c9957b69f48881fec0b1db9e92

                                        SHA512

                                        0c9cb6b9e9e516237b4656a09c0045e6e5a02dc52937950a557fe6eb16a03b591b6f271a9a801f954bafbc65bb6c39ded4331f3309e9d25e04c0cd9008650d40

                                      • C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat

                                        Filesize

                                        199B

                                        MD5

                                        4bde47e0091024864777edc2e5a6910c

                                        SHA1

                                        72a2be13a76f670f8ffe6de69708a02f3633a667

                                        SHA256

                                        971d7590f04b6323f6f8308caab4cd8ddc877760dd62d5f3560b6d2fa82accfe

                                        SHA512

                                        7672a8416d9bcb43d22e4f69feb68519053f10b3f34f00d4975b50dd40768bc69c54ae8a95fffced96593b12aa39352b0bcdb39e2e10b820be1a3eabe124c6ea

                                      • C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat

                                        Filesize

                                        199B

                                        MD5

                                        4c809db92c67788162b679337a3305b3

                                        SHA1

                                        bc13858b35ce421b078b1c1ab8aa62c310e9c986

                                        SHA256

                                        bf20abc2954313ec8ad21c5a5e778d63f9599195c8e440bcba6011b83ea526d5

                                        SHA512

                                        32a58c423cb710cc51a6933bbe56f5c8cafd715ffce4b113c6cb7575c38dbbbee16a7a89627af3be74fadc482b2f0c7295041f135d8abf4430de7e42ec6ec428

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5prrydgm.bix.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat

                                        Filesize

                                        199B

                                        MD5

                                        df5dc7eede421718c8dc4199ba44f902

                                        SHA1

                                        30c7947839be07dec9a0d53c14a54b12c02d8ae3

                                        SHA256

                                        38c3697e7fc0c43f60eae307d32ad6fd76b5959d5548a3bd712bd0b67e54ee02

                                        SHA512

                                        55f37e08b948ab76748d80ded5f4075622b3bdd0846183afd1df3c9b79f82ed1cf6b39ec436e27177169d3a148b8e0ac9856961d3c825bde49cc327f8cb054dd

                                      • C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

                                        Filesize

                                        199B

                                        MD5

                                        68302cc5776e93ea62481318b34843cc

                                        SHA1

                                        f74de70ba38d9ffd33e8edb0f7eda3fcd4139b74

                                        SHA256

                                        e1750ecd0b840e11b975dd3bb9a2030c930545d7dd1c71fb1a563dfdbe1eb5d6

                                        SHA512

                                        cb9f786eea258ea9efb224886fb4d9b79b94b21b4e8c74f49be4cb3dff9acd96f7bbfd35c494f00d57e43fb1cc75c3d545c2b8cd658406e0c8bcb44ed622aad2

                                      • C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat

                                        Filesize

                                        199B

                                        MD5

                                        3cfe5ae27ad7148f6f8a80b4fbcd471a

                                        SHA1

                                        4b77eeb7b5110be413868dd1a381afc728fb296d

                                        SHA256

                                        ba2cbf80181667dcf898e46cb1aa233e285f49c1ffc3d1be104bde17287ab799

                                        SHA512

                                        944327a72667d7946c408356bf968d3f8c84be151114777cc42f4e720e0d30111f1d855a7fdbafa7aef3c107e74df0971febc37a474237ee8f80a58520791a73

                                      • C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat

                                        Filesize

                                        199B

                                        MD5

                                        6bb0300cf20e1791d3cfc876867eb734

                                        SHA1

                                        9403e6d344587310bb0039cfff07133be7640490

                                        SHA256

                                        2104b836c7f433f150f8c382936f60088cdd7197ad1a422daba2e1d53c85370c

                                        SHA512

                                        29e999872669543ee32bd4eda057eaead18b0620d39831acf8f64351b9533c5b0432f039c839ed5bf586dd9ad116049b66c8a263e684a16e0e6b420183cccc24

                                      • C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat

                                        Filesize

                                        199B

                                        MD5

                                        7fe1c26cfdd3ee187d43f3aabb9d0393

                                        SHA1

                                        3f8e87bbe962e7fc5fca76935773b04026ad53d1

                                        SHA256

                                        f1fa145a0cab4ec024eb2077c6eb96e802dd64bfbd7ff15431d8402f09398257

                                        SHA512

                                        3efba2118def8feda7268b22f36401ff32c6173b0854b38787e286322bcab395a345a2799f9c6a463aa776385613e0d580243fcd95162afa188d15b2676304b2

                                      • C:\Users\Admin\AppData\Local\Temp\sT6xLp4JQ8.bat

                                        Filesize

                                        199B

                                        MD5

                                        6c9da34115c34ca10ad62dbbfb5ff950

                                        SHA1

                                        b17d8a71289541b643bc7373b14e5dbe811b731b

                                        SHA256

                                        bf419d0f240965b40620ad31b76a7fa0917f89420780865e3f0541773871d270

                                        SHA512

                                        6f0363999bc80769b5a16bf7ffa00df639557430c6562e5c9110d0edb89975406f03c7e416af3dc0008d9bc9f76357d8272ec547379095527fdde15ca3bb55a5

                                      • C:\Users\Admin\AppData\Local\Temp\wLA3izB53h.bat

                                        Filesize

                                        199B

                                        MD5

                                        caa2eb0a84f90fe48f85c265c305587a

                                        SHA1

                                        c1197c9ff946d76d958844a8a622c1583762221f

                                        SHA256

                                        76c9a157fc56dd3af602ac788e3a3254c04f2b375cbba87889ed0ecf962265a6

                                        SHA512

                                        5a6b01922be59ee371f1a92ffe7cc871b9c62e491613a86a07dd6d93524fda2f22400136ae3b12fa5b2fb070464e632e45d0b0c401f2a96b8ab89f956155339c

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/1636-38-0x000001AB63180000-0x000001AB631A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1732-246-0x000000001BBF0000-0x000000001BD5A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1732-247-0x000000001BDA0000-0x000000001BDF6000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/2308-13-0x00000000001F0000-0x0000000000300000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2308-15-0x0000000002520000-0x000000000252C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2308-14-0x00000000024C0000-0x00000000024D2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2308-12-0x00007FF9F5393000-0x00007FF9F5395000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2308-17-0x0000000002540000-0x000000000254C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2308-16-0x0000000002530000-0x000000000253C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2412-274-0x0000000002B20000-0x0000000002B32000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2680-97-0x0000000002CA0000-0x0000000002CB2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2700-230-0x000000001BDD0000-0x000000001BF3A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/2700-225-0x0000000000B10000-0x0000000000B22000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2848-222-0x000000001BCF0000-0x000000001BD25000-memory.dmp

                                        Filesize

                                        212KB

                                      • memory/2848-221-0x000000001C4C0000-0x000000001C5C2000-memory.dmp

                                        Filesize

                                        1.0MB

                                      • memory/2848-216-0x0000000001880000-0x0000000001892000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3352-238-0x000000001C300000-0x000000001C46A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/3352-239-0x000000001B4C0000-0x000000001B516000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/3352-233-0x00000000028F0000-0x0000000002902000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3624-178-0x0000000000950000-0x0000000000962000-memory.dmp

                                        Filesize

                                        72KB