dcrat | fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe
Size

1.3MB
MD5

d675b99d2735fbb35531e109bbdbe15e
SHA1

814557e02d03440b91308e444ec105af13d8cfb8
SHA256

fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392
SHA512

d36fd054a0a862817e3501d03bfb7278c5e1e5262264edaa075b634633165bc22a92a2c9f8a0e5ee063e35aea3daf59d0435f561248ccbcf97adeab6dd2ceae9
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2752	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2752	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000019227-9.dat	dcrat
behavioral1/memory/2400-13-0x00000000013C0000-0x00000000014D0000-memory.dmp	dcrat
behavioral1/memory/1412-157-0x0000000000950000-0x0000000000A60000-memory.dmp	dcrat
behavioral1/memory/1872-217-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat
behavioral1/memory/2468-277-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat
behavioral1/memory/1324-337-0x0000000001030000-0x0000000001140000-memory.dmp	dcrat
behavioral1/memory/2684-515-0x0000000000100000-0x0000000000210000-memory.dmp	dcrat
behavioral1/memory/1668-575-0x0000000000020000-0x0000000000130000-memory.dmp	dcrat
behavioral1/memory/1932-635-0x0000000000AE0000-0x0000000000BF0000-memory.dmp	dcrat
behavioral1/memory/1968-695-0x00000000012B0000-0x00000000013C0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1732	powershell.exe
2600	powershell.exe
2772	powershell.exe
2056	powershell.exe
2500	powershell.exe
1424	powershell.exe
2376	powershell.exe
600	powershell.exe
1548	powershell.exe
2808	powershell.exe
2924	powershell.exe
2968	powershell.exe
2828	powershell.exe
1948	powershell.exe
2360	powershell.exe
2832	powershell.exe
2780	powershell.exe
2716	powershell.exe
2768	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2400	DllCommonsvc.exe
1412	taskhost.exe
1872	taskhost.exe
2468	taskhost.exe
1324	taskhost.exe
1008	taskhost.exe
2596	taskhost.exe
2684	taskhost.exe
1668	taskhost.exe
1932	taskhost.exe
1968	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2304	cmd.exe
2304	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
9	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\lsm.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe	DllCommonsvc.exe
File created	C:\Windows\security\ApplicationId\PolicyManagement\b75386f1303e64	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2180	schtasks.exe
396	schtasks.exe
1724	schtasks.exe
2224	schtasks.exe
1604	schtasks.exe
1060	schtasks.exe
1544	schtasks.exe
1852	schtasks.exe
1524	schtasks.exe
2084	schtasks.exe
1556	schtasks.exe
568	schtasks.exe
2028	schtasks.exe
2684	schtasks.exe
2460	schtasks.exe
1224	schtasks.exe
1412	schtasks.exe
2388	schtasks.exe
2272	schtasks.exe
2640	schtasks.exe
856	schtasks.exe
2232	schtasks.exe
2220	schtasks.exe
2992	schtasks.exe
1428	schtasks.exe
348	schtasks.exe
2944	schtasks.exe
1132	schtasks.exe
1896	schtasks.exe
1736	schtasks.exe
1972	schtasks.exe
2588	schtasks.exe
1976	schtasks.exe
2488	schtasks.exe
2100	schtasks.exe
540	schtasks.exe
1688	schtasks.exe
2136	schtasks.exe
2668	schtasks.exe
1416	schtasks.exe
2068	schtasks.exe
2132	schtasks.exe
1784	schtasks.exe
2924	schtasks.exe
1628	schtasks.exe
1576	schtasks.exe
1408	schtasks.exe
2676	schtasks.exe
276	schtasks.exe
3008	schtasks.exe
1884	schtasks.exe
1368	schtasks.exe
2520	schtasks.exe
1584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2400	DllCommonsvc.exe
2400	DllCommonsvc.exe
2400	DllCommonsvc.exe
2400	DllCommonsvc.exe
2400	DllCommonsvc.exe
2968	powershell.exe
2828	powershell.exe
2716	powershell.exe
2360	powershell.exe
2772	powershell.exe
1732	powershell.exe
2500	powershell.exe
2832	powershell.exe
1548	powershell.exe
600	powershell.exe
1948	powershell.exe
2780	powershell.exe
2600	powershell.exe
2768	powershell.exe
2056	powershell.exe
2376	powershell.exe
2808	powershell.exe
1424	powershell.exe
2924	powershell.exe
1412	taskhost.exe
1872	taskhost.exe
2468	taskhost.exe
1324	taskhost.exe
1008	taskhost.exe
2596	taskhost.exe
2684	taskhost.exe
1668	taskhost.exe
1932	taskhost.exe
1968	taskhost.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	DllCommonsvc.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1412	taskhost.exe
Token: SeDebugPrivilege	1872	taskhost.exe
Token: SeDebugPrivilege	2468	taskhost.exe
Token: SeDebugPrivilege	1324	taskhost.exe
Token: SeDebugPrivilege	1008	taskhost.exe
Token: SeDebugPrivilege	2596	taskhost.exe
Token: SeDebugPrivilege	2684	taskhost.exe
Token: SeDebugPrivilege	1668	taskhost.exe
Token: SeDebugPrivilege	1932	taskhost.exe
Token: SeDebugPrivilege	1968	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2432	2100	JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe	30
PID 2100 wrote to memory of 2432	2100	JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe	30
PID 2100 wrote to memory of 2432	2100	JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe	30
PID 2100 wrote to memory of 2432	2100	JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe	30
PID 2432 wrote to memory of 2304	2432	WScript.exe	32
PID 2432 wrote to memory of 2304	2432	WScript.exe	32
PID 2432 wrote to memory of 2304	2432	WScript.exe	32
PID 2432 wrote to memory of 2304	2432	WScript.exe	32
PID 2304 wrote to memory of 2400	2304	cmd.exe	34
PID 2304 wrote to memory of 2400	2304	cmd.exe	34
PID 2304 wrote to memory of 2400	2304	cmd.exe	34
PID 2304 wrote to memory of 2400	2304	cmd.exe	34
PID 2400 wrote to memory of 2968	2400	DllCommonsvc.exe	90
PID 2400 wrote to memory of 2968	2400	DllCommonsvc.exe	90
PID 2400 wrote to memory of 2968	2400	DllCommonsvc.exe	90
PID 2400 wrote to memory of 2716	2400	DllCommonsvc.exe	91
PID 2400 wrote to memory of 2716	2400	DllCommonsvc.exe	91
PID 2400 wrote to memory of 2716	2400	DllCommonsvc.exe	91
PID 2400 wrote to memory of 2780	2400	DllCommonsvc.exe	92
PID 2400 wrote to memory of 2780	2400	DllCommonsvc.exe	92
PID 2400 wrote to memory of 2780	2400	DllCommonsvc.exe	92
PID 2400 wrote to memory of 600	2400	DllCommonsvc.exe	93
PID 2400 wrote to memory of 600	2400	DllCommonsvc.exe	93
PID 2400 wrote to memory of 600	2400	DllCommonsvc.exe	93
PID 2400 wrote to memory of 2832	2400	DllCommonsvc.exe	94
PID 2400 wrote to memory of 2832	2400	DllCommonsvc.exe	94
PID 2400 wrote to memory of 2832	2400	DllCommonsvc.exe	94
PID 2400 wrote to memory of 2056	2400	DllCommonsvc.exe	96
PID 2400 wrote to memory of 2056	2400	DllCommonsvc.exe	96
PID 2400 wrote to memory of 2056	2400	DllCommonsvc.exe	96
PID 2400 wrote to memory of 2768	2400	DllCommonsvc.exe	98
PID 2400 wrote to memory of 2768	2400	DllCommonsvc.exe	98
PID 2400 wrote to memory of 2768	2400	DllCommonsvc.exe	98
PID 2400 wrote to memory of 2500	2400	DllCommonsvc.exe	99
PID 2400 wrote to memory of 2500	2400	DllCommonsvc.exe	99
PID 2400 wrote to memory of 2500	2400	DllCommonsvc.exe	99
PID 2400 wrote to memory of 2828	2400	DllCommonsvc.exe	100
PID 2400 wrote to memory of 2828	2400	DllCommonsvc.exe	100
PID 2400 wrote to memory of 2828	2400	DllCommonsvc.exe	100
PID 2400 wrote to memory of 2772	2400	DllCommonsvc.exe	101
PID 2400 wrote to memory of 2772	2400	DllCommonsvc.exe	101
PID 2400 wrote to memory of 2772	2400	DllCommonsvc.exe	101
PID 2400 wrote to memory of 2808	2400	DllCommonsvc.exe	102
PID 2400 wrote to memory of 2808	2400	DllCommonsvc.exe	102
PID 2400 wrote to memory of 2808	2400	DllCommonsvc.exe	102
PID 2400 wrote to memory of 2360	2400	DllCommonsvc.exe	105
PID 2400 wrote to memory of 2360	2400	DllCommonsvc.exe	105
PID 2400 wrote to memory of 2360	2400	DllCommonsvc.exe	105
PID 2400 wrote to memory of 2600	2400	DllCommonsvc.exe	106
PID 2400 wrote to memory of 2600	2400	DllCommonsvc.exe	106
PID 2400 wrote to memory of 2600	2400	DllCommonsvc.exe	106
PID 2400 wrote to memory of 2376	2400	DllCommonsvc.exe	108
PID 2400 wrote to memory of 2376	2400	DllCommonsvc.exe	108
PID 2400 wrote to memory of 2376	2400	DllCommonsvc.exe	108
PID 2400 wrote to memory of 1732	2400	DllCommonsvc.exe	109
PID 2400 wrote to memory of 1732	2400	DllCommonsvc.exe	109
PID 2400 wrote to memory of 1732	2400	DllCommonsvc.exe	109
PID 2400 wrote to memory of 1948	2400	DllCommonsvc.exe	110
PID 2400 wrote to memory of 1948	2400	DllCommonsvc.exe	110
PID 2400 wrote to memory of 1948	2400	DllCommonsvc.exe	110
PID 2400 wrote to memory of 2924	2400	DllCommonsvc.exe	112
PID 2400 wrote to memory of 2924	2400	DllCommonsvc.exe	112
PID 2400 wrote to memory of 2924	2400	DllCommonsvc.exe	112
PID 2400 wrote to memory of 1548	2400	DllCommonsvc.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fbdbde3ae37ba41e7617c70a4d4de4b71058e3de9aa8344e351b7cff9eba4392.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\microsoft shared\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\VisualElements\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\plugins\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft Help\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\de-DE\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YAkRWmVbYY.bat"
        5⤵
        
        PID:2748
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2488
      - C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat"
        7⤵
        
        PID:1496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2100
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        9⤵
        
        PID:1544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2440
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        11⤵
        
        PID:836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2460
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gyyX5OxKdc.bat"
        13⤵
        
        PID:1252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1476
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"
        15⤵
        
        PID:2528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1740
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat"
        17⤵
        
        PID:408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2680
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjTee716Rl.bat"
        19⤵
        
        PID:1108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:856
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
        21⤵
        
        PID:1608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2780
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tfVhKC50lX.bat"
        23⤵
        
        PID:1744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1712
        
        C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe
        
        "C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat"
        25⤵
        
        PID:2368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\Sample Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\microsoft shared\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\plugins\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\plugins\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\fr-FR\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\fr-FR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft Help\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft Help\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55e641779fc590681b6286b848c31b0a

SHA1
f294d5e8c1928707675447eccbaf26b7e6c7e178

SHA256
0c110b2f7ee7b785f4b7a43bc077b724ad3b5b60ebe82227a70e60c3a89b778c

SHA512
a3d838f571c5c9879c4413d9f70f80f43fc0c92b56dc354e7b7bc601377f72b98bfabf6dedceca898affa1c0e5e1d9856e58e3abe350985b5fc543ba2cd8e69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1677ff75718f33cbba108446af2586c

SHA1
7f2c2c294fe42497e5095826e24cea476d0ef6d3

SHA256
935c6617a3654ab780cce37b46b102e6e311806f033739bdc5356cde19f16115

SHA512
23cba81252427d1707a0430c409f06020260be009b00331fad1f973fa7d5dabdf98026e74bfd9ede7c60ef99b08a3d88509b5e8881afaf99a2f7d8f666dbd9b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7de9f2130ebadaca273f848bcafc0c92

SHA1
4af95a7b81c1ae09233a8d2a7b31b11be1b5b413

SHA256
afa45f1bb0bda4840b85b2d17a6cb5a5ed7811c48a46b8ad36ed4d2401b409af

SHA512
d1aae8f967631528fb1cd3dd49e2fd61f51b953affc1cb4f36f5fbc4c32997a4f4ea4ff6e8bb2f0eb917d0fcf505464760898aa3e3828ef4814c28ea87dc0276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cfc7314542d3d208cf4415e394d0456

SHA1
b20fb8040a6e5f0ed4ed69a91905a31adba98d7d

SHA256
d4f981d1a662779ea0471e8cf2b3f01bb7db4a18253266891b982bb4db26c578

SHA512
527940f60cdd0df9504f3e7528481f85dc1b6257dcd1570fdad7cee501e55b44131b24b8629027e86c1393f3cb94aa3bb55edc719b4a43682fa8247b0a3e3732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749b510ef835679d793395fbd7e18982

SHA1
94264bfbf2a2e538873530ef081b3b13f3bf2716

SHA256
3b2744274f753e47aa7918d4a2467cc68db02699484d841571ae4b5f5c8944fb

SHA512
83cca16fbcd23bdd6280b8b7c0adede41bceb132746248a27ca05aa1c88369e37992237a9c63b41ec62a87d2e8855b606163df31b65dc56528f71464fd70afd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51ab90c221995133098970b0f87b2754

SHA1
65ca5d7dcf38b3e5c2564c431a73d7cf90167909

SHA256
3b1f6fc3e68362dbadbc104ff4d0b6f3d96a898d52bee3d40785ce4bbaf481f2

SHA512
dbe6754b4d3f1b5f699abc1276c21b8b6852a30217e52c650cc2c51e88b2237a2825b4afc84b8c594e5a747d8902851ce3c57d7c76e6e3ee509d09d1de56cf8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04e5e51384b8b752acb594de7567d2a

SHA1
652c92b6f2c4ad0af745c09432a1cf59b3c025b6

SHA256
9aa7d4a9e7b8b0a254245eff0ac0df229b40a5881569f090007de4fb22c907ba

SHA512
15228bd68889afc99e171916c12b6cf254a98b5ff0ce7f5f3208aa0181a0ad4aef3634b6bee479f23e1f994b0e53baf8e5b59e57c6cf267ed250e223924fce48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf8a5e4777b1ffa2ec50591873e0848b

SHA1
b6e24f0eee459ba3dcbbb18ec3108f627f9264df

SHA256
ae8cff0f6dea949abafc58fe3cf900221f6fa9df21e52f35aa693b0a04fd1aa2

SHA512
32b7397172dfb241e182b364e1046a677687b96f96fd61f1aa015458a17a0f89d1f24bf1ead998eb78d659de7a83504450f41b7fed105a9fd0b11945e605f174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa986b8a0ff64242896df3669185c60

SHA1
235890b2db25143250e75f7f2c16f35c775540f8

SHA256
915f341a85b5c62159439c926ed91512cbdef93d4fd4c2bb37c0fe3e7ac5cb58

SHA512
a88c6160f1155ebfb9f9002a482528cc75c0848d303340cfac9eff1402a3a9add884688cee839f4f0f51a11b2a11755981129569876ae1fbd93b03d74be38b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

Filesize
228B

MD5
bf67ccee41422c898fdc7d14a7065405

SHA1
fa5a533d185cf9551dd5f5a217104cba369a0f08

SHA256
cf53ad6fa2439effcc6a774548eaa7c058f6b3c4d48496fd06c81b8024f89463

SHA512
07b9793637fabc87429d46456f72b2c8e768183c16b0b3a2fc89eb9e7631c3479e9e110d4b776cd72cf17f94d9fb8c57ef5d34fd5c80a6441c10a37eb7c18dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25DA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat

Filesize
228B

MD5
d1e9ea563aba2fa553a7ebde4c4223a8

SHA1
41dd0c7148d29670abe5ecb5f1860e982026f9ef

SHA256
8555d8a27ec11138c5ce5b0b0f472841471c437f1aaf41ae0adbb52b5f3555a7

SHA512
c5bd6660ac62471adc5118816fef0e8ce71434db081fd8902f9b2af6d854971ebe3b761cc078bc476791ec25c579afcf91fefc95f452b7cd054e0b6b82b207a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
228B

MD5
e1462b3c68f76c34a79a21c1db989859

SHA1
c0c0d80dfc1e310f11dfcce8e8146dc1c099b2ee

SHA256
dc4a155f8f9c77c5f5c4eed67decda4bac3239d3d8d253b9228d0195e0c8dbf9

SHA512
287ac2f3050d7ffffb3f279a1fbe99430879919619620b4da1afcd137cf85c90024b78f87fa68a0869d1490a3fef0e43f09ebe66880423e2c2eece2fc8d5cad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\YAkRWmVbYY.bat

Filesize
228B

MD5
84c9d2f47d048f47446e0c9fca39b756

SHA1
4f490935d40fb75258c3d8aff7119dc7dddbbeef

SHA256
802a4b364abb708d6de94df293bcbc42d9f1ad10600c3dcb14e77d103a158579

SHA512
365c6e1b7443cd07abc518746c46297893b99ea2de693256d06467001d3e474a06724ccbcd12bc3a790d21fa92560531d894f82fb090684ad76d3e493f8862e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat

Filesize
228B

MD5
ec00e89930f4bfc1f880dbac1eb008fd

SHA1
ef3292a9dec6f6e517ef1c8b1cb0768131bdd384

SHA256
077b147c57b288d624be8d0a93971faac79c4f1439f0c8450b1e35e606338696

SHA512
325867120df9581ffe404caac38d9d2ac02609542bc05aeb61a0d0676257d46d35c42dd09f93587d1b3a028941ffb96f9fbf2b90067b2882cd781a1f8320184c

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyyX5OxKdc.bat

Filesize
228B

MD5
ff1564018ae9d66b5e2a8d9ac8ccb54b

SHA1
6b8e10072ffec851889e0fbad0d0c2dadbcd4ac2

SHA256
6a8a0632cfd4653a5802e4e5da6524dce2c2fdc7af9b6f241c17fe0204b8f8c2

SHA512
241b8a78400bc2d9d04df6db8c0c78bbd3f26325fbbe417b228a11f76abab4ad62e3b16d1f582a2c10041edd4350ddb609f95b23c4c2ae7a036fd12972c78df6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat

Filesize
228B

MD5
92d8ea73e8da52af65618f8eed67b792

SHA1
c17b80813844ca37ba528edfa85529ed9e556322

SHA256
b819b09aff80585e6e6ceeac6dfa1554f2729183c7961a9ea03ecbe62d5def22

SHA512
3436ffe7b44aa913adeaca93b63f6075a493aa835fe8ba0cbfd51a046f0341f09377144c7ec740fe0f8682b5e2d1acda9fcff80f70a56df756bd3af803ec775b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat

Filesize
228B

MD5
b1f3c0d1bd4c8c92dde5f3adc4d6ba73

SHA1
582dec0cee5958ab356c0bb86ee37bdf5b17e38a

SHA256
21c133407b61fb2f6bf7c2e8441a391075e2100a1d1d1902b264c5e15f53dfff

SHA512
df35a7a740ff49d9d58abdca040c10ed69a7cd398fb01e3d2f0d09391fd4902aef119fbb1c7d836c51a3a3e9161789c1f85949a5470ceaa58c8952c08013359b

Download Submit
C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat

Filesize
228B

MD5
a30a3cedbc115a2e476f0465d2005f24

SHA1
924114a02ff87cb4d1f8f6765012a991e2184286

SHA256
64be4ff48df49103e8f6018ef30885b98c1f8d63722b9140133ef3e724f7b335

SHA512
ed8e9a4ba94b059d791177fd24d46b710e673d59c0fdb18f6255406114f3c434d5840c8b0a25fe69ad32ea6b4f98415ea1fb4cb98a9854b0a89c151b59bba1c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjTee716Rl.bat

Filesize
228B

MD5
2e80271479fff4b39e04b8216c0f6434

SHA1
90a2a563f8026585f1452ebf12f9d4a2f7a143a8

SHA256
373a136ab1b69a407f75ae02c38bd3a2f073578a4f842c3f92a63b478e8fed7b

SHA512
4cae47dc25b355aa6e953e9f566aab2803316ac3a400e2e479241ef554157c890754622065ec2e0d9c761a2a3c628f5f4926a706758a3fe74836f88c67584003

Download Submit
C:\Users\Admin\AppData\Local\Temp\tfVhKC50lX.bat

Filesize
228B

MD5
c66f6de498ae7773c604bddd6a5bcb5e

SHA1
2a70d3cafeebff7683311df6644d9db8519a8ea8

SHA256
9ec48425298d6e8d085c1d12799bb05699eb1a0216f909a16ec8fc1d98c53531

SHA512
0bda55d4c41f0128c440809b2933952e090d769f71eae1898df665b7c8d01c24e4fae0b1cba78dcc17b4ed4b04332aa1134a8f13a58f8eaa31577545de321284

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
29828bb0bfcd3d09ac53cecda084b710

SHA1
2fa2ed30156090897ee2c606540e9c0fc77d2fac

SHA256
5798268b75b4b527989c57a842eb574d873acb5e97dbc15ff72b00856c96e540

SHA512
66bef94b60d9e77523e64a12072f7c7cbc3210418815b4a8ff99d90804954e2185486137cbf47870288684ff422c856afac661ab80635d4ec3c96e854181b2f8

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1324-337-0x0000000001030000-0x0000000001140000-memory.dmp

Filesize
1.1MB

Download
memory/1412-158-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1412-157-0x0000000000950000-0x0000000000A60000-memory.dmp

Filesize
1.1MB

Download
memory/1668-575-0x0000000000020000-0x0000000000130000-memory.dmp

Filesize
1.1MB

Download
memory/1872-217-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/1932-635-0x0000000000AE0000-0x0000000000BF0000-memory.dmp

Filesize
1.1MB

Download
memory/1968-696-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1968-695-0x00000000012B0000-0x00000000013C0000-memory.dmp

Filesize
1.1MB

Download
memory/2400-16-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2400-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2400-17-0x0000000000180000-0x000000000018C000-memory.dmp

Filesize
48KB

Download
memory/2400-15-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2400-13-0x00000000013C0000-0x00000000014D0000-memory.dmp

Filesize
1.1MB

Download
memory/2468-277-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2684-515-0x0000000000100000-0x0000000000210000-memory.dmp

Filesize
1.1MB

Download
memory/2828-67-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2968-108-0x00000000020B0000-0x00000000020B8000-memory.dmp

Filesize
32KB

Download