dcrat | dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
Size

1.3MB
MD5

f881b76d06402dcf78ca64540da3d9f6
SHA1

ace8988ea925758dacbb0a2bb135f2a0c994c890
SHA256

dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc
SHA512

d60449ab08172e4bff713be4add0f04746f79a24662a3a3cc717a138b7bb2ddd93cd4ae401cfbdc311f1f6784811944bb6f0306cf089924c569a057565137fdc
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1172	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1172	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000015d7f-9.dat	dcrat
behavioral1/memory/2632-13-0x00000000008C0000-0x00000000009D0000-memory.dmp	dcrat
behavioral1/memory/2792-80-0x00000000003C0000-0x00000000004D0000-memory.dmp	dcrat
behavioral1/memory/2404-218-0x00000000010C0000-0x00000000011D0000-memory.dmp	dcrat
behavioral1/memory/3020-574-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/1928-634-0x0000000000D60000-0x0000000000E70000-memory.dmp	dcrat
behavioral1/memory/1744-694-0x0000000001040000-0x0000000001150000-memory.dmp	dcrat
behavioral1/memory/3012-754-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1764	powershell.exe
2080	powershell.exe
2404	powershell.exe
2152	powershell.exe
484	powershell.exe
1272	powershell.exe
580	powershell.exe
2680	powershell.exe
2648	powershell.exe
2712	powershell.exe
2936	powershell.exe
2108	powershell.exe
2996	powershell.exe
572	powershell.exe
3044	powershell.exe
2804	powershell.exe
588	powershell.exe
1324	powershell.exe
2444	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2632	DllCommonsvc.exe
2792	dwm.exe
2404	dwm.exe
2428	dwm.exe
2240	dwm.exe
2112	dwm.exe
2488	dwm.exe
2236	dwm.exe
3020	dwm.exe
1928	dwm.exe
1744	dwm.exe
3012	dwm.exe

Loads dropped DLL 2 IoCs

pid	Process
2900	cmd.exe
2900	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
29	raw.githubusercontent.com
36	raw.githubusercontent.com
32	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\it-IT\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\it-IT\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Windows\debug\WIA\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\debug\WIA\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\assembly\GAC_MSIL\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\GAC_MSIL\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\lsm.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
1440	schtasks.exe
3012	schtasks.exe
2264	schtasks.exe
836	schtasks.exe
1772	schtasks.exe
2412	schtasks.exe
2128	schtasks.exe
2980	schtasks.exe
2604	schtasks.exe
2076	schtasks.exe
2036	schtasks.exe
2624	schtasks.exe
2448	schtasks.exe
1348	schtasks.exe
1520	schtasks.exe
700	schtasks.exe
1680	schtasks.exe
2888	schtasks.exe
2204	schtasks.exe
936	schtasks.exe
2920	schtasks.exe
2236	schtasks.exe
2156	schtasks.exe
2088	schtasks.exe
1664	schtasks.exe
2072	schtasks.exe
1200	schtasks.exe
1556	schtasks.exe
1652	schtasks.exe
1328	schtasks.exe
1820	schtasks.exe
884	schtasks.exe
1612	schtasks.exe
1908	schtasks.exe
960	schtasks.exe
2824	schtasks.exe
1060	schtasks.exe
2556	schtasks.exe
1968	schtasks.exe
2876	schtasks.exe
1492	schtasks.exe
2832	schtasks.exe
2280	schtasks.exe
2852	schtasks.exe
2664	schtasks.exe
1112	schtasks.exe
2200	schtasks.exe
1744	schtasks.exe
2300	schtasks.exe
2880	schtasks.exe
2716	schtasks.exe
1660	schtasks.exe
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2632	DllCommonsvc.exe
2632	DllCommonsvc.exe
2632	DllCommonsvc.exe
2632	DllCommonsvc.exe
2632	DllCommonsvc.exe
2632	DllCommonsvc.exe
2632	DllCommonsvc.exe
2648	powershell.exe
572	powershell.exe
2804	powershell.exe
3044	powershell.exe
2080	powershell.exe
1324	powershell.exe
2404	powershell.exe
580	powershell.exe
1764	powershell.exe
2936	powershell.exe
2996	powershell.exe
2680	powershell.exe
2152	powershell.exe
2792	dwm.exe
484	powershell.exe
2444	powershell.exe
1272	powershell.exe
588	powershell.exe
2108	powershell.exe
2712	powershell.exe
2404	dwm.exe
2428	dwm.exe
2240	dwm.exe
2112	dwm.exe
2488	dwm.exe
2236	dwm.exe
3020	dwm.exe
1928	dwm.exe
1744	dwm.exe
3012	dwm.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	DllCommonsvc.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2792	dwm.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2404	dwm.exe
Token: SeDebugPrivilege	2428	dwm.exe
Token: SeDebugPrivilege	2240	dwm.exe
Token: SeDebugPrivilege	2112	dwm.exe
Token: SeDebugPrivilege	2488	dwm.exe
Token: SeDebugPrivilege	2236	dwm.exe
Token: SeDebugPrivilege	3020	dwm.exe
Token: SeDebugPrivilege	1928	dwm.exe
Token: SeDebugPrivilege	1744	dwm.exe
Token: SeDebugPrivilege	3012	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2804	2748	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	30
PID 2748 wrote to memory of 2804	2748	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	30
PID 2748 wrote to memory of 2804	2748	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	30
PID 2748 wrote to memory of 2804	2748	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	30
PID 2804 wrote to memory of 2900	2804	WScript.exe	31
PID 2804 wrote to memory of 2900	2804	WScript.exe	31
PID 2804 wrote to memory of 2900	2804	WScript.exe	31
PID 2804 wrote to memory of 2900	2804	WScript.exe	31
PID 2900 wrote to memory of 2632	2900	cmd.exe	33
PID 2900 wrote to memory of 2632	2900	cmd.exe	33
PID 2900 wrote to memory of 2632	2900	cmd.exe	33
PID 2900 wrote to memory of 2632	2900	cmd.exe	33
PID 2632 wrote to memory of 2804	2632	DllCommonsvc.exe	89
PID 2632 wrote to memory of 2804	2632	DllCommonsvc.exe	89
PID 2632 wrote to memory of 2804	2632	DllCommonsvc.exe	89
PID 2632 wrote to memory of 2648	2632	DllCommonsvc.exe	90
PID 2632 wrote to memory of 2648	2632	DllCommonsvc.exe	90
PID 2632 wrote to memory of 2648	2632	DllCommonsvc.exe	90
PID 2632 wrote to memory of 2680	2632	DllCommonsvc.exe	91
PID 2632 wrote to memory of 2680	2632	DllCommonsvc.exe	91
PID 2632 wrote to memory of 2680	2632	DllCommonsvc.exe	91
PID 2632 wrote to memory of 3044	2632	DllCommonsvc.exe	92
PID 2632 wrote to memory of 3044	2632	DllCommonsvc.exe	92
PID 2632 wrote to memory of 3044	2632	DllCommonsvc.exe	92
PID 2632 wrote to memory of 1764	2632	DllCommonsvc.exe	93
PID 2632 wrote to memory of 1764	2632	DllCommonsvc.exe	93
PID 2632 wrote to memory of 1764	2632	DllCommonsvc.exe	93
PID 2632 wrote to memory of 484	2632	DllCommonsvc.exe	95
PID 2632 wrote to memory of 484	2632	DllCommonsvc.exe	95
PID 2632 wrote to memory of 484	2632	DllCommonsvc.exe	95
PID 2632 wrote to memory of 572	2632	DllCommonsvc.exe	96
PID 2632 wrote to memory of 572	2632	DllCommonsvc.exe	96
PID 2632 wrote to memory of 572	2632	DllCommonsvc.exe	96
PID 2632 wrote to memory of 580	2632	DllCommonsvc.exe	97
PID 2632 wrote to memory of 580	2632	DllCommonsvc.exe	97
PID 2632 wrote to memory of 580	2632	DllCommonsvc.exe	97
PID 2632 wrote to memory of 2444	2632	DllCommonsvc.exe	99
PID 2632 wrote to memory of 2444	2632	DllCommonsvc.exe	99
PID 2632 wrote to memory of 2444	2632	DllCommonsvc.exe	99
PID 2632 wrote to memory of 1272	2632	DllCommonsvc.exe	100
PID 2632 wrote to memory of 1272	2632	DllCommonsvc.exe	100
PID 2632 wrote to memory of 1272	2632	DllCommonsvc.exe	100
PID 2632 wrote to memory of 2152	2632	DllCommonsvc.exe	101
PID 2632 wrote to memory of 2152	2632	DllCommonsvc.exe	101
PID 2632 wrote to memory of 2152	2632	DllCommonsvc.exe	101
PID 2632 wrote to memory of 2404	2632	DllCommonsvc.exe	102
PID 2632 wrote to memory of 2404	2632	DllCommonsvc.exe	102
PID 2632 wrote to memory of 2404	2632	DllCommonsvc.exe	102
PID 2632 wrote to memory of 2996	2632	DllCommonsvc.exe	103
PID 2632 wrote to memory of 2996	2632	DllCommonsvc.exe	103
PID 2632 wrote to memory of 2996	2632	DllCommonsvc.exe	103
PID 2632 wrote to memory of 2080	2632	DllCommonsvc.exe	104
PID 2632 wrote to memory of 2080	2632	DllCommonsvc.exe	104
PID 2632 wrote to memory of 2080	2632	DllCommonsvc.exe	104
PID 2632 wrote to memory of 2108	2632	DllCommonsvc.exe	105
PID 2632 wrote to memory of 2108	2632	DllCommonsvc.exe	105
PID 2632 wrote to memory of 2108	2632	DllCommonsvc.exe	105
PID 2632 wrote to memory of 1324	2632	DllCommonsvc.exe	108
PID 2632 wrote to memory of 1324	2632	DllCommonsvc.exe	108
PID 2632 wrote to memory of 1324	2632	DllCommonsvc.exe	108
PID 2632 wrote to memory of 588	2632	DllCommonsvc.exe	110
PID 2632 wrote to memory of 588	2632	DllCommonsvc.exe	110
PID 2632 wrote to memory of 588	2632	DllCommonsvc.exe	110
PID 2632 wrote to memory of 2936	2632	DllCommonsvc.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC_MSIL\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat"
        6⤵
        
        PID:2504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1524
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"
        8⤵
        
        PID:2564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1952
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat"
        10⤵
        
        PID:3008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2236
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat"
        12⤵
        
        PID:2172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2792
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat"
        14⤵
        
        PID:1728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:908
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0x9T38u1li.bat"
        16⤵
        
        PID:1516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2400
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat"
        18⤵
        
        PID:2448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2092
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uruRJY5g5x.bat"
        20⤵
        
        PID:2508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2868
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat"
        22⤵
        
        PID:2008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1544
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat"
        24⤵
        
        PID:1568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1816
        
        C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
        
        "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\WIA\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\debug\WIA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\WIA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\GAC_MSIL\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_MSIL\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_MSIL\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a857d3646e8c4eb3cf86d575352301f8

SHA1
a1dc8ebdf49a03a1f4b7e340d478a134019b1ac7

SHA256
0c5c353bb0d1a6db618dea95a13f7286ebc578084c4767880d9c460d70bdc5c5

SHA512
d360717617641ae286e0a29cb140435ebb4685b8aa809006f83053f67856d4801849fdf6d42419e4b0b6e22ea91fa5a16f46145210cdef4490ad472d650b291b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd150ec0b4151fea54ecce79ed6e1249

SHA1
4f906d9fb07a7325922d6a0229302c36a2198d74

SHA256
ca24708ccdc8680730ec8d1448b95415e6d7b5ea4b28c9cd1610b7c70af93e59

SHA512
2a220917faaec88c4baed7032f62d4516f300b7d45e44dfedd50a7a56304dd582f215b689e50f350f3db8014302d8610e062fcbfa2f104078b84aade50134078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0204771214976f7bdbb33fefbcb3c57

SHA1
406a4c3e218a5c654c9a7c41f2c1d633f0587885

SHA256
9a780b9f8088a98fc39134ddf624a0259ddda039bc12258fe4c2d7fc1d29922d

SHA512
3d79488cf38a16c4ed1e1516aedb2ef271635fde330c2f96c91a56aec57de98df2b9af613391b26d8811081546067323645bafeed759c6c26ffae003131bddde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f7b6ce319e8aa017af75914f35d7220

SHA1
ce173c6627d802a38623262e0ee546bfa86957f9

SHA256
94bc62092af3959f997c80c75d6d36155c4ff926cdab25c4f848c5b96386fcc3

SHA512
162403a7f32a1570023c1720d10d2d307ccc40ea25ee7a5a4370f65ffda66bafa1d193983aea59017e47e753d14eed9f507e26c959314d1cf8c8f6bc482649d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1e9f81fa67e4943b0a1731caf44103

SHA1
833219a68a35021e05c3dabbf85ed43bcd0b9ed7

SHA256
8654b63a6f356af177be9e06062f53e6f1e5b683cd9dc4e70936c828ebeb02bc

SHA512
145584479485536d5e7be85ee050fbaa24fa0d5748ca9e41dd9f8dfe6cdfb315631b170c5494fb09e59d1bd94eacabf799fc9e56babef0ee5be78eb8dbda717e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
152088c427b713d98b5a0e934bd07cfb

SHA1
f27cc64ba3723e53e8d363608c63cee3a2fb2a93

SHA256
25762b019b7aa0da39df5283ec6bfc95c024c1249c732ebd3843f647485980bb

SHA512
a97cbef002c257ec224696899b7419a16a03a40a8eea461f3165a2b44e8ae78b88d9cfd09116908f2432f0030cbf63024f093236515c15f982d554efc195b502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6a5d2459da1e1e744b71cb2eff2471

SHA1
991bd74b830f746baf7e45dd48eed1854a7ebd5e

SHA256
53608b22ca909adebec671a2321e2523c7dc18f79247f176246adb6437121236

SHA512
b608266a55832e8ef687f5ada29e11b4d74612c7f6fdfb4590772d63dc61d6f03a1e1e32673b72620062dcb244c6c103fba8e0a30e02f3d89e709332a7e971a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75478524c9b18c18b6ba2c4b016db72e

SHA1
2bddae009b2733d9384dc3b3abacd8aa1b2bd6ab

SHA256
9221d7816eb40c31fb394b195ec33e727635022980af684d3fa55b778bdba526

SHA512
3dc715924f2300f9598b0983fffbfbe8366c0c6687b07dcfa3d007037209885669685c8fa98099ac6261d3b89b193038dbc6d1cfa27e0de3f1f4eb98bc3af5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2cd14a5a77c4a8ac24f3e8789139a94

SHA1
6f77032c3ada76c4234b67795bdb39d79e9aee1c

SHA256
69f091ac08c66dd4ea002d3cc7d3646dd579615b2d6182207c389738e68b9de5

SHA512
231a2ab55bb5a6f5ba20f21d7b45e42177f7f7f72ec0cff1cffa661c4015521d8fba83d3195828b78b509ab3c32488dfade756c82a754a764383ddf481e128bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\0x9T38u1li.bat

Filesize
223B

MD5
3e85e35561e3c313e53cf84f35535730

SHA1
a5f1c22ac7325024de0749d8723144acacd4a471

SHA256
3c992295274ed70bbdbdfb26463a2993767f5f82f9cf93f39851b17a8b38eeec

SHA512
e4bfd0196349fce06599278620042e0097776bc7ad0b2aa304bcdd1000c87c151dd665e85751052fe3c26f2b9df764ec24423788f7069b0a2395d2acc0d4d816

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA7B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat

Filesize
223B

MD5
3cc7776604e667564f78da4f80e5ae36

SHA1
1a6c876690bc2820a79f9e8d9c5a21ce479e0c54

SHA256
e906b85fd419cf7b106067d2eca586f38866708752794b92480131be48f719d7

SHA512
bf1c7c664fc52fa19645989d6f597640a79b6e5b58d18aebb76141270dc2765da36df425431e0cbd42c1ae4aeca7cd5596e1d09431633368a0d80bb73adf8fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat

Filesize
223B

MD5
0da0426545d4ec1606f213247863d1f8

SHA1
1b76f2185d1088ee3e00788a5e77a0d9558d3d7e

SHA256
7be72991b98aa7df573a12530ffb7a55ff464eb137012dc0edad9965ec813197

SHA512
54a54feed11e15d9aec9dd72a4be7ad7c32d30c564241e67c72192756f7520b81795c57e367e2871a6cbb873a9f3c35026c12887cf183fca401ec7a469999ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\be8zRZs4e0.bat

Filesize
223B

MD5
9835289d6b2e70c07feb72317be66d51

SHA1
d923f74aa5e5b8fed01c0873a339f8ef5bb17c27

SHA256
c98de6c3a4f949fa3548a2e3b5f69fc03c574beafd971718d60a05411e6aecd7

SHA512
7e3fe50c5eea65f9d74f425ebdd2ab702d9480b1cc2e6a564e10b4d44a19d5fcef491cb48126dcc061e0cc168d4bb54acea1080f030cbb871e1d0ad5ece2d06c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat

Filesize
223B

MD5
3cbf8f788867408c1599de292fcf5246

SHA1
ef0f8ec68fca75a87bc25b38b7d13f23aff73194

SHA256
9122f8f48a138f1baf47b9a0b50e47648f6dbe37b2f1ea44c89d8048171bb9ac

SHA512
b1f026ac58125bd48290be3f4b9438224f800eff2478027fb964ede7e290f7d0942946262131268bd6506d90d6dd6701f71ab0a173529abda424ed774fafddd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat

Filesize
223B

MD5
52842dfcf117576c59381839016e14ec

SHA1
6b422d578deff8fc8400cf06133f823b82a9e9fe

SHA256
eb348a212738b8bde873fbe400aa8ddbcb9c64407ce56a9c209115b077d8076c

SHA512
53dfa81126a1465579bb28540eea0314515422df585629c67cfb54dc1ea430eaf2ca23371a7c1894274295e694c8fee8c8be4df739c2b2f9c62fb60d060dee3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\uruRJY5g5x.bat

Filesize
223B

MD5
e0f147a2894646d5e819c39b58168c19

SHA1
c1cf87286429f44dfb9d67c85fe0ed4a67b2dad1

SHA256
9947e643051ca0cfa9fa529ff6140026eaa9fa16a7cc2bba8e4babf6b2523778

SHA512
d9d88ed18836dc00865d8bd1b384026d52a69144dfaf53586d93e1d6282b725ec244f7c2f7a0e2ca3e18b7e4467f39bbeea69320846cd87c6ed38ae0951859e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat

Filesize
223B

MD5
4629d531ab1058779a6b001bf7e46656

SHA1
4825cf3c1f1d5e2cd725e46003cd0f24712371fd

SHA256
a3bdc313edeef40189986196118c4ef7d7d24cd1c9f27112e7dbefdccab200d0

SHA512
feca81da5d2d0b024535d7672c78df551979cf58b140eed10b0c45107d0770992bf72848226d49cf6074a999bb79dfd84a33cfe7614958439265560d395522c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat

Filesize
223B

MD5
f0c02e8f9b75b017f83b7cb3927b911c

SHA1
6ac550c7ada5e682dc9f589e55a8250404ff327e

SHA256
b1b74880b39bc25a504401bfd44da2beb8fcc1d4625e85830458c66ed01cfab7

SHA512
bb1aa46629d5a3cbfb6cae98c9014f7728ad6b1cbbc5b1269fbaa18f3f76f7598421176f0c18ac013e6922b4667eeb2d39ee165e7e59cef313cbd745ede506da

Download Submit
C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat

Filesize
223B

MD5
020ceac3faaedbbd61b15e38e90d937d

SHA1
c257b280c3c45714b1d2d524870b99a0d141524c

SHA256
bcb1b12d51afcd75398a47f896f87a1f1b0d07ac3c27f372142654a1be62cefb

SHA512
1f9ebd01105bb074a706cf4b5d002ee5f0c46acaffd367c01d944e3719cea331e9c4cc6d2aef9380e33ecf69eccf85dd4bd4bc3611828bfff583d8e877772042

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
42a20167cbc5cd72ec940101a7673994

SHA1
3ede161d077f4f6ac28236d83172fcf718eb2b57

SHA256
5f09c216e65af002e2619dcc37f67bc025a9f0d1154143acdfed759c31ea5643

SHA512
7bcb3764f2c354de673562b2e7dccf41bfef69803c79ec062be2dae279cc48a86d81544a8407a193e776b85711d565b9792635aa77effa6161e0265df27b90e9

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1744-694-0x0000000001040000-0x0000000001150000-memory.dmp

Filesize
1.1MB

Download
memory/1928-634-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/2404-218-0x00000000010C0000-0x00000000011D0000-memory.dmp

Filesize
1.1MB

Download
memory/2404-219-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2632-15-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2632-17-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2632-16-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2632-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2632-13-0x00000000008C0000-0x00000000009D0000-memory.dmp

Filesize
1.1MB

Download
memory/2648-86-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/2648-79-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2792-80-0x00000000003C0000-0x00000000004D0000-memory.dmp

Filesize
1.1MB

Download
memory/2792-123-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/3012-754-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/3020-574-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download