dcrat | 0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe
Size

1.3MB
MD5

791a0a7b231a7442ca41ff0877283983
SHA1

5efbcf9831702723617ddec2b918fb6a44375576
SHA256

0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96
SHA512

59e5aa8077cba6a5fcd431a6465ca24fb855677c05b68910ea3a6e3b5a1875de142f9b8957ca85a1e911767939fb8bb69cd7630ba8a1c54c8ac1a13e0b0b0eff
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2600	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2600	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c66-9.dat	dcrat
behavioral1/memory/2684-13-0x0000000000CE0000-0x0000000000DF0000-memory.dmp	dcrat
behavioral1/memory/2124-157-0x0000000000180000-0x0000000000290000-memory.dmp	dcrat
behavioral1/memory/2728-216-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/1628-276-0x0000000000EA0000-0x0000000000FB0000-memory.dmp	dcrat
behavioral1/memory/2852-395-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/1124-455-0x0000000000FA0000-0x00000000010B0000-memory.dmp	dcrat
behavioral1/memory/1628-515-0x00000000001B0000-0x00000000002C0000-memory.dmp	dcrat
behavioral1/memory/2416-575-0x0000000001300000-0x0000000001410000-memory.dmp	dcrat
behavioral1/memory/944-694-0x0000000000100000-0x0000000000210000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe
2248	powershell.exe
2764	powershell.exe
2712	powershell.exe
2608	powershell.exe
2728	powershell.exe
3016	powershell.exe
2444	powershell.exe
2960	powershell.exe
2876	powershell.exe
2220	powershell.exe
3028	powershell.exe
840	powershell.exe
2300	powershell.exe
2000	powershell.exe
2704	powershell.exe
2344	powershell.exe
2520	powershell.exe
2744	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2684	DllCommonsvc.exe
2124	conhost.exe
2728	conhost.exe
1628	conhost.exe
2064	conhost.exe
2852	conhost.exe
1124	conhost.exe
1628	conhost.exe
2416	conhost.exe
2492	conhost.exe
944	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1876	cmd.exe
1876	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
26	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\27d1bcfc3c54e0	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Registration\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Documents\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Documents\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\6203df4a6bafc7	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
772	schtasks.exe
2076	schtasks.exe
1692	schtasks.exe
2504	schtasks.exe
1988	schtasks.exe
1356	schtasks.exe
1000	schtasks.exe
1412	schtasks.exe
3064	schtasks.exe
2852	schtasks.exe
2196	schtasks.exe
2148	schtasks.exe
1340	schtasks.exe
800	schtasks.exe
1780	schtasks.exe
2780	schtasks.exe
2156	schtasks.exe
556	schtasks.exe
2184	schtasks.exe
1912	schtasks.exe
2992	schtasks.exe
2556	schtasks.exe
2596	schtasks.exe
2088	schtasks.exe
1544	schtasks.exe
2204	schtasks.exe
1528	schtasks.exe
1948	schtasks.exe
1728	schtasks.exe
1464	schtasks.exe
2208	schtasks.exe
1008	schtasks.exe
2692	schtasks.exe
2704	schtasks.exe
1196	schtasks.exe
948	schtasks.exe
1672	schtasks.exe
1844	schtasks.exe
1124	schtasks.exe
1684	schtasks.exe
1656	schtasks.exe
1676	schtasks.exe
1924	schtasks.exe
1952	schtasks.exe
2884	schtasks.exe
2360	schtasks.exe
1836	schtasks.exe
2840	schtasks.exe
2836	schtasks.exe
2564	schtasks.exe
3060	schtasks.exe
2296	schtasks.exe
1980	schtasks.exe
3036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2684	DllCommonsvc.exe
2684	DllCommonsvc.exe
2684	DllCommonsvc.exe
2684	DllCommonsvc.exe
2684	DllCommonsvc.exe
840	powershell.exe
1900	powershell.exe
2960	powershell.exe
2248	powershell.exe
3028	powershell.exe
2728	powershell.exe
2444	powershell.exe
2608	powershell.exe
2520	powershell.exe
2000	powershell.exe
2300	powershell.exe
3016	powershell.exe
2712	powershell.exe
2764	powershell.exe
2744	powershell.exe
2876	powershell.exe
2220	powershell.exe
2704	powershell.exe
2344	powershell.exe
2124	conhost.exe
2728	conhost.exe
1628	conhost.exe
2064	conhost.exe
2852	conhost.exe
1124	conhost.exe
1628	conhost.exe
2416	conhost.exe
2492	conhost.exe
944	conhost.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	DllCommonsvc.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2124	conhost.exe
Token: SeDebugPrivilege	2728	conhost.exe
Token: SeDebugPrivilege	1628	conhost.exe
Token: SeDebugPrivilege	2064	conhost.exe
Token: SeDebugPrivilege	2852	conhost.exe
Token: SeDebugPrivilege	1124	conhost.exe
Token: SeDebugPrivilege	1628	conhost.exe
Token: SeDebugPrivilege	2416	conhost.exe
Token: SeDebugPrivilege	2492	conhost.exe
Token: SeDebugPrivilege	944	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2912	1776	JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe	30
PID 1776 wrote to memory of 2912	1776	JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe	30
PID 1776 wrote to memory of 2912	1776	JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe	30
PID 1776 wrote to memory of 2912	1776	JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe	30
PID 2912 wrote to memory of 1876	2912	WScript.exe	31
PID 2912 wrote to memory of 1876	2912	WScript.exe	31
PID 2912 wrote to memory of 1876	2912	WScript.exe	31
PID 2912 wrote to memory of 1876	2912	WScript.exe	31
PID 1876 wrote to memory of 2684	1876	cmd.exe	33
PID 1876 wrote to memory of 2684	1876	cmd.exe	33
PID 1876 wrote to memory of 2684	1876	cmd.exe	33
PID 1876 wrote to memory of 2684	1876	cmd.exe	33
PID 2684 wrote to memory of 840	2684	DllCommonsvc.exe	89
PID 2684 wrote to memory of 840	2684	DllCommonsvc.exe	89
PID 2684 wrote to memory of 840	2684	DllCommonsvc.exe	89
PID 2684 wrote to memory of 1900	2684	DllCommonsvc.exe	90
PID 2684 wrote to memory of 1900	2684	DllCommonsvc.exe	90
PID 2684 wrote to memory of 1900	2684	DllCommonsvc.exe	90
PID 2684 wrote to memory of 2300	2684	DllCommonsvc.exe	91
PID 2684 wrote to memory of 2300	2684	DllCommonsvc.exe	91
PID 2684 wrote to memory of 2300	2684	DllCommonsvc.exe	91
PID 2684 wrote to memory of 2444	2684	DllCommonsvc.exe	94
PID 2684 wrote to memory of 2444	2684	DllCommonsvc.exe	94
PID 2684 wrote to memory of 2444	2684	DllCommonsvc.exe	94
PID 2684 wrote to memory of 3028	2684	DllCommonsvc.exe	96
PID 2684 wrote to memory of 3028	2684	DllCommonsvc.exe	96
PID 2684 wrote to memory of 3028	2684	DllCommonsvc.exe	96
PID 2684 wrote to memory of 2744	2684	DllCommonsvc.exe	97
PID 2684 wrote to memory of 2744	2684	DllCommonsvc.exe	97
PID 2684 wrote to memory of 2744	2684	DllCommonsvc.exe	97
PID 2684 wrote to memory of 2220	2684	DllCommonsvc.exe	98
PID 2684 wrote to memory of 2220	2684	DllCommonsvc.exe	98
PID 2684 wrote to memory of 2220	2684	DllCommonsvc.exe	98
PID 2684 wrote to memory of 3016	2684	DllCommonsvc.exe	99
PID 2684 wrote to memory of 3016	2684	DllCommonsvc.exe	99
PID 2684 wrote to memory of 3016	2684	DllCommonsvc.exe	99
PID 2684 wrote to memory of 2960	2684	DllCommonsvc.exe	100
PID 2684 wrote to memory of 2960	2684	DllCommonsvc.exe	100
PID 2684 wrote to memory of 2960	2684	DllCommonsvc.exe	100
PID 2684 wrote to memory of 2728	2684	DllCommonsvc.exe	101
PID 2684 wrote to memory of 2728	2684	DllCommonsvc.exe	101
PID 2684 wrote to memory of 2728	2684	DllCommonsvc.exe	101
PID 2684 wrote to memory of 2520	2684	DllCommonsvc.exe	102
PID 2684 wrote to memory of 2520	2684	DllCommonsvc.exe	102
PID 2684 wrote to memory of 2520	2684	DllCommonsvc.exe	102
PID 2684 wrote to memory of 2876	2684	DllCommonsvc.exe	103
PID 2684 wrote to memory of 2876	2684	DllCommonsvc.exe	103
PID 2684 wrote to memory of 2876	2684	DllCommonsvc.exe	103
PID 2684 wrote to memory of 2608	2684	DllCommonsvc.exe	104
PID 2684 wrote to memory of 2608	2684	DllCommonsvc.exe	104
PID 2684 wrote to memory of 2608	2684	DllCommonsvc.exe	104
PID 2684 wrote to memory of 2712	2684	DllCommonsvc.exe	105
PID 2684 wrote to memory of 2712	2684	DllCommonsvc.exe	105
PID 2684 wrote to memory of 2712	2684	DllCommonsvc.exe	105
PID 2684 wrote to memory of 2248	2684	DllCommonsvc.exe	108
PID 2684 wrote to memory of 2248	2684	DllCommonsvc.exe	108
PID 2684 wrote to memory of 2248	2684	DllCommonsvc.exe	108
PID 2684 wrote to memory of 2344	2684	DllCommonsvc.exe	111
PID 2684 wrote to memory of 2344	2684	DllCommonsvc.exe	111
PID 2684 wrote to memory of 2344	2684	DllCommonsvc.exe	111
PID 2684 wrote to memory of 2000	2684	DllCommonsvc.exe	113
PID 2684 wrote to memory of 2000	2684	DllCommonsvc.exe	113
PID 2684 wrote to memory of 2000	2684	DllCommonsvc.exe	113
PID 2684 wrote to memory of 2764	2684	DllCommonsvc.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e5dbf0f499a9d6dacf1b82fa00193e8aa4eeb95a1df58bfe1ab475eab202c96.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Documents\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5lmwERz1FX.bat"
        5⤵
        
        PID:1996
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2836
      - C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat"
        7⤵
        
        PID:2896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2912
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RjWoOVK6wo.bat"
        9⤵
        
        PID:1660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:840
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9j3rBUpSkc.bat"
        11⤵
        
        PID:2348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2816
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xB9FX11cFJ.bat"
        13⤵
        
        PID:1980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2124
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cxnNEsMM51.bat"
        15⤵
        
        PID:1272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:752
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat"
        17⤵
        
        PID:2744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1344
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat"
        19⤵
        
        PID:564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2264
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        21⤵
        
        PID:2972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2256
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat"
        23⤵
        
        PID:2840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1420
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Windows\Registration\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Registration\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Pictures\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\RemotePackages\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\RemotePackages\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfc43c00c77d5df029cc4aaf6027ef46

SHA1
c72e570290e385647abdc7ecbce9eb845991b506

SHA256
4e455e036c39f21e8f35f06d5162d793496a9a0b6ba0d3ab48ed2a8b8febcf60

SHA512
1101d52c77f5f35fdec6483e4ea44091acceed4af1696744a83ff9bdf84314ba48ed04b5a1220c8b16c5bece20da548f4014bb37da322fab5a8b60073504101e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
259439d2fe9d5c65ee11de1dc718ab97

SHA1
4ce15a9adbfc16c207f62c50237b66d9d4fc4b64

SHA256
fdcfd9e3d18dbf3f952a6fb1534fee5bedf2b75a011c019489ea66f91d4eea24

SHA512
c8eeef7930d170ba4bf6a1d9b9e2475828f066ebdf0c60b19d7b90bc73109ccb576e42aa2521dea1bd55c5041ea6cae9ba71dd4f0388c48dd301943c5533598f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e43481cdbea430a277806fda4fa1eef0

SHA1
f3cef39136771933b4fe48f9b2698d2649415308

SHA256
8458faab49076c3858fb45ddbefa966c6fbaa9c6f2f2b9a99c6980234db458c2

SHA512
f400ac4b7e82e039d5c487802fc0f9d9c61a995d2f7f98db4dc6238c5e5331db00e2b05d262796216cf63edccb529cfcb12d02e17f24eda354fee2e38f1bd602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
073bf8294975fb7e85f983d214cf9444

SHA1
941d4381dbb9f6b8b559ed3d310b459896aae06d

SHA256
e289aaa7fdd7260ed683386035749b8209fe237eeb32931bd24039cdf6ee69a9

SHA512
0c44aef9f3ec3d2e03f1e73f1dcd2ca52d0928928ee649658c6b6226fb281d01b4d87ee7b29fa74e7260ed482932c929f544e8628f5712a5b11581424cc2525d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdc2de6b0ddf0bf74bfe7fea571d3d0c

SHA1
b965fac4f363ec31546be5153b2421a81aee9525

SHA256
0c5602a49c580ee61c9660ffe2645ae66fc42e2e03765b7ad5d96ec822315bd4

SHA512
47c57a4d06ee14335be6aa46d2152c48ec04b9e10e1ad54ee171409962afbf46f914e57f614e924bb6081fba5e3bec2953397f28d1b3c6c861bad44e74add894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f862ae7e1acbc76d2640bcc5e1e438b

SHA1
c4cb6a6052510af6048412584f09dde7c92a6d7b

SHA256
9f69cb3b0769df7497e44891b5433683f7373fb88b700b55a89ec96820f3fce0

SHA512
a90563ebf3acaf305dc2c8ada7c5b7b3c259004c8b8c191fccce725b80c3a769b46db143fb237d67b425d220c4c306f69f790709330b8fe866d4fcf8c42b1b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d96d38ae69077d2ebda098fbf51276f

SHA1
33aa024fbd4920a4d32526d7f348888b86635cf3

SHA256
e1f6ef0949e554852fa6fbcd5f193137679416343d1f64f60a03e84c04feef5d

SHA512
45db090fe5fdc42f5d384705f5ccd40c49faaca99d64e2ddfa798de97aed32815293c73aa466a69c39def392f1c14f636aeb97f149744954f37630568aee3107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67317f93f08a5e5293db06e4b77ace53

SHA1
4cd3758cdcca95bac79c71d523f14d21dd071087

SHA256
35e9c9394f3387d2fb845475a60a60d0827279d7e9a825d509ef418b0052dc7c

SHA512
0f5d588fff05cd541cbd1f0b6cbfb54ec10a78f88f6087964dc8a531c8754da23e4fff2a46f52b0f26a7a38ae28178344ebeb8f6d35f77f73e467cb686dc09ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\5lmwERz1FX.bat

Filesize
225B

MD5
1e0b153e23070d3b34df48e2179027ce

SHA1
1a0bc73d9fe2268e059e722369b88dcce64104ac

SHA256
22625fb9a1437dc81c88134c1980e4796c026bffa8a2431f23f20c76bc41fdf4

SHA512
5254ccff2e761fed1ca99b8bace8e41c5e80f5c0312732f880ad63f8f8d031c6f3373b505f5ba9b7c48472b31c438e72c5e5e524d33d3ff3982cce3471518768

Download Submit
C:\Users\Admin\AppData\Local\Temp\9j3rBUpSkc.bat

Filesize
225B

MD5
896cef1088a0dc32b9f48ca7f5cce78c

SHA1
898a4a529aecf5d734a5168e2fa8d4bca2f5dff0

SHA256
7fd1c17da27e32545ca773d8b73981169fe53e3a1d87668436de5757a1b7068b

SHA512
1e1b2ee53e552913441c662c9b0f78fe675f08f3a144cf7534e2fe6f5f4924b6ff15ebf1fffc478e6538a9238e65585361b8cdf784a8e47fff797c580af2cd85

Download Submit
C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat

Filesize
225B

MD5
63099e0f038dc69064f8bc565790c6bc

SHA1
14df2091824a5d145ea78b4513ac6507e96e29e8

SHA256
9eb16185ae3f8fa6038c916b16fe0e223814b5479c4f7a2816d9380367619010

SHA512
714d6a434b495f24a14330480eb00b539d4514fb742f572b59f164fc9d50b24f032c7f819fe3575515938314a6070f24dfae9b9d78a33daf055ac4ed4ef6db9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF73C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat

Filesize
225B

MD5
bdfc2ffa767944834062d1a30632e5e4

SHA1
3cd62c0e7a85febbcb05701a95be3d46b369c169

SHA256
ee75bdaf9f7071ad1ee1a76ad2b44cb3135f88375561198c33e002ff530d4807

SHA512
75477cda14312b07a7366415dcdc6203eb75fab3c2b783f1d75deb5986753e4402525f99cb5f77e338cbac132a3f702f92825cf730ae897d0c1a3ebf8acef8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat

Filesize
225B

MD5
d86ebf9bea8004dda8afdc559d7a4836

SHA1
4eacf453bf0e81536132d321a7d9045e80da1c1b

SHA256
42a230170836e438891067ea595f9abe3a20959a5da756963b8056a3db4437d9

SHA512
1b01f1d26b7d2cd1843702925851bd021ef740a2132dadf50dd5031ba11762a969254075cd0faf95cbeba333f4733498c8ca4b85e24fd197517bf6dd871d1a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\RjWoOVK6wo.bat

Filesize
225B

MD5
919e774536b01c4ad99d98fcf960218d

SHA1
c7d1624c3624a4bd9cf16ff04815ef3412a379eb

SHA256
cfca7fb8510c5fceef930ebc6e41170bd5f0bdf3cdbbc9a3c5284195d16bd94b

SHA512
3ab67c754ee2e6358b6dff6748b9b6650126a34ae9c043d2f66650e03a5fe4f2f085adc5ed73d02d2763bff23e5672cb6187fcc4f763e270bd2427a7f650a058

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF75F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat

Filesize
225B

MD5
69e29c6a5307b19efc16052f89f40322

SHA1
95ebe3a1d733bc9340ae23b752cd05cadc878e09

SHA256
f8aa30865f2a48f03223486ccfd278a92a4e0baadd52740bf3b8c79c908373b5

SHA512
ef8715c07aab24c76d03d1c4c7fee5e073f2feed31db1d91d609df8067dedc35db2d2926b3ac4ca578629adf6f23ae0e15eaf2411ef764283442c2e2812748f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat

Filesize
225B

MD5
f47005eb58f2474b88defb558b90f140

SHA1
54e02a5b15924608d44530fe2dfb62e88dfea6e5

SHA256
da9927146356825fb4c75e02b4f86b66a92b1557b49854b354daa43163049bc5

SHA512
86ccfb98eb89bf11d77c71152d5244ca75a4ced511d3204fffbe0d2f68e03dd72c46eb2d418b8fbecee03159a0477c25396d88abfcae39a013718ba8fef9976f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxnNEsMM51.bat

Filesize
225B

MD5
3db09ca5f7f70f824abbfd2d2456f205

SHA1
0dd746bf1b21d505f8cfd6268185dfce854ef701

SHA256
e096046bf354a1ad4c2be60d389c7eca808e9994b0851f6f25513196897e5343

SHA512
b46870e6eb7ba150866ae578ecc7f7afddc598d11d9db9596564a9132c89bd43e3073bcc3a89fd6317d35507987b52296ec968abba63f3c3f47ad22647bda12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xB9FX11cFJ.bat

Filesize
225B

MD5
2cbdd82052f577954c8b78efb3aa4d38

SHA1
05272d437765c19be140c1aa0db0d2fa0ae3e20e

SHA256
a311461d4b4493dc3849d916ea1599917dfe6be5388113d98f86d4326c53cb95

SHA512
f5dfd7539c26f55b4cbd9e5330caab95d7adf03520121b10edbacb0d8b9660a335e364dd3e398b821d06876c7d2a29e1ff82b4ea11aad4fd94e5cbcca468b8e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c7af5a0711c352aa3caefe9b664bad28

SHA1
f20a98ab98dfc33a8771beeebe2d965426944adf

SHA256
9c96c81d744e08bd825449f13a1d4c96a1c15e03f5e06722cffe0912092e7ad7

SHA512
5fb0106728e28e8e1302d4acb4434f09dc1cf2fa2c5a51ce34b5cae297f21a28ab71ed348cd506799e172f18187b5212fc1c716bf430474be52b48ea7268b7dc

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/840-63-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/840-68-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/944-694-0x0000000000100000-0x0000000000210000-memory.dmp

Filesize
1.1MB

Download
memory/1124-455-0x0000000000FA0000-0x00000000010B0000-memory.dmp

Filesize
1.1MB

Download
memory/1628-276-0x0000000000EA0000-0x0000000000FB0000-memory.dmp

Filesize
1.1MB

Download
memory/1628-515-0x00000000001B0000-0x00000000002C0000-memory.dmp

Filesize
1.1MB

Download
memory/2124-157-0x0000000000180000-0x0000000000290000-memory.dmp

Filesize
1.1MB

Download
memory/2416-575-0x0000000001300000-0x0000000001410000-memory.dmp

Filesize
1.1MB

Download
memory/2684-16-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2684-17-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2684-15-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/2684-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2684-13-0x0000000000CE0000-0x0000000000DF0000-memory.dmp

Filesize
1.1MB

Download
memory/2728-216-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2852-395-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download