dcrat | f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe
Size

1.3MB
MD5

3ade70d0bcbe87ce8e66cb6417f9f922
SHA1

8e24a3bdfb5a06ea841391b1da4e71769048c2b0
SHA256

f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4
SHA512

15663a11217472c6c2c488d57bf17608408794e3f394fefe12b789a2c0f76061cb57f4514b1516638c79fd87bc954201501564843ee23450d16d18f129640eef
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2892	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2892	schtasks.exe	34

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0009000000016ccd-9.dat	dcrat
behavioral1/memory/2756-13-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2968-154-0x0000000000270000-0x0000000000380000-memory.dmp	dcrat
behavioral1/memory/1340-213-0x0000000001150000-0x0000000001260000-memory.dmp	dcrat
behavioral1/memory/1920-274-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/1740-335-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat
behavioral1/memory/2840-395-0x0000000000260000-0x0000000000370000-memory.dmp	dcrat
behavioral1/memory/2004-455-0x0000000000A70000-0x0000000000B80000-memory.dmp	dcrat
behavioral1/memory/1560-515-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/2900-575-0x0000000000170000-0x0000000000280000-memory.dmp	dcrat
behavioral1/memory/1840-635-0x00000000008A0000-0x00000000009B0000-memory.dmp	dcrat
behavioral1/memory/2632-695-0x0000000000B80000-0x0000000000C90000-memory.dmp	dcrat
behavioral1/memory/1816-755-0x0000000000CA0000-0x0000000000DB0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2924	powershell.exe
2632	powershell.exe
2744	powershell.exe
2704	powershell.exe
2792	powershell.exe
1340	powershell.exe
1464	powershell.exe
3040	powershell.exe
2292	powershell.exe
2188	powershell.exe
2960	powershell.exe
1948	powershell.exe
2612	powershell.exe
692	powershell.exe
2544	powershell.exe
2716	powershell.exe
2652	powershell.exe
2872	powershell.exe
2732	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2756	DllCommonsvc.exe
2968	winlogon.exe
1340	winlogon.exe
1920	winlogon.exe
1740	winlogon.exe
2840	winlogon.exe
2004	winlogon.exe
1560	winlogon.exe
2900	winlogon.exe
1840	winlogon.exe
2632	winlogon.exe
1816	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1284	cmd.exe
1284	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
32	raw.githubusercontent.com
36	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
29	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
23	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\de-DE\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\de-DE\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\cmd.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\servicing\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Registration\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\spoolsv.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2564	schtasks.exe
2672	schtasks.exe
1416	schtasks.exe
924	schtasks.exe
1856	schtasks.exe
3068	schtasks.exe
2784	schtasks.exe
236	schtasks.exe
2500	schtasks.exe
2576	schtasks.exe
556	schtasks.exe
1008	schtasks.exe
2676	schtasks.exe
844	schtasks.exe
2036	schtasks.exe
2424	schtasks.exe
2588	schtasks.exe
2188	schtasks.exe
1952	schtasks.exe
2312	schtasks.exe
2980	schtasks.exe
2792	schtasks.exe
2168	schtasks.exe
1832	schtasks.exe
1656	schtasks.exe
2968	schtasks.exe
2000	schtasks.exe
2620	schtasks.exe
3056	schtasks.exe
828	schtasks.exe
1972	schtasks.exe
2288	schtasks.exe
2064	schtasks.exe
2948	schtasks.exe
2480	schtasks.exe
2356	schtasks.exe
1380	schtasks.exe
904	schtasks.exe
1004	schtasks.exe
644	schtasks.exe
2452	schtasks.exe
1696	schtasks.exe
2080	schtasks.exe
1588	schtasks.exe
1236	schtasks.exe
1164	schtasks.exe
2592	schtasks.exe
2488	schtasks.exe
2940	schtasks.exe
1508	schtasks.exe
3040	schtasks.exe
652	schtasks.exe
1568	schtasks.exe
2264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2756	DllCommonsvc.exe
2652	powershell.exe
2716	powershell.exe
2704	powershell.exe
2872	powershell.exe
2188	powershell.exe
2612	powershell.exe
1948	powershell.exe
2732	powershell.exe
2924	powershell.exe
2544	powershell.exe
2960	powershell.exe
2292	powershell.exe
2744	powershell.exe
2632	powershell.exe
1340	powershell.exe
2792	powershell.exe
692	powershell.exe
1464	powershell.exe
3040	powershell.exe
2968	winlogon.exe
1340	winlogon.exe
1920	winlogon.exe
1740	winlogon.exe
2840	winlogon.exe
2004	winlogon.exe
1560	winlogon.exe
2900	winlogon.exe
1840	winlogon.exe
2632	winlogon.exe
1816	winlogon.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	DllCommonsvc.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2968	winlogon.exe
Token: SeDebugPrivilege	1340	winlogon.exe
Token: SeDebugPrivilege	1920	winlogon.exe
Token: SeDebugPrivilege	1740	winlogon.exe
Token: SeDebugPrivilege	2840	winlogon.exe
Token: SeDebugPrivilege	2004	winlogon.exe
Token: SeDebugPrivilege	1560	winlogon.exe
Token: SeDebugPrivilege	2900	winlogon.exe
Token: SeDebugPrivilege	1840	winlogon.exe
Token: SeDebugPrivilege	2632	winlogon.exe
Token: SeDebugPrivilege	1816	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2544	3028	JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe	30
PID 3028 wrote to memory of 2544	3028	JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe	30
PID 3028 wrote to memory of 2544	3028	JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe	30
PID 3028 wrote to memory of 2544	3028	JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe	30
PID 2544 wrote to memory of 1284	2544	WScript.exe	31
PID 2544 wrote to memory of 1284	2544	WScript.exe	31
PID 2544 wrote to memory of 1284	2544	WScript.exe	31
PID 2544 wrote to memory of 1284	2544	WScript.exe	31
PID 1284 wrote to memory of 2756	1284	cmd.exe	33
PID 1284 wrote to memory of 2756	1284	cmd.exe	33
PID 1284 wrote to memory of 2756	1284	cmd.exe	33
PID 1284 wrote to memory of 2756	1284	cmd.exe	33
PID 2756 wrote to memory of 2704	2756	DllCommonsvc.exe	89
PID 2756 wrote to memory of 2704	2756	DllCommonsvc.exe	89
PID 2756 wrote to memory of 2704	2756	DllCommonsvc.exe	89
PID 2756 wrote to memory of 2544	2756	DllCommonsvc.exe	90
PID 2756 wrote to memory of 2544	2756	DllCommonsvc.exe	90
PID 2756 wrote to memory of 2544	2756	DllCommonsvc.exe	90
PID 2756 wrote to memory of 2716	2756	DllCommonsvc.exe	91
PID 2756 wrote to memory of 2716	2756	DllCommonsvc.exe	91
PID 2756 wrote to memory of 2716	2756	DllCommonsvc.exe	91
PID 2756 wrote to memory of 2744	2756	DllCommonsvc.exe	94
PID 2756 wrote to memory of 2744	2756	DllCommonsvc.exe	94
PID 2756 wrote to memory of 2744	2756	DllCommonsvc.exe	94
PID 2756 wrote to memory of 2292	2756	DllCommonsvc.exe	96
PID 2756 wrote to memory of 2292	2756	DllCommonsvc.exe	96
PID 2756 wrote to memory of 2292	2756	DllCommonsvc.exe	96
PID 2756 wrote to memory of 2960	2756	DllCommonsvc.exe	97
PID 2756 wrote to memory of 2960	2756	DllCommonsvc.exe	97
PID 2756 wrote to memory of 2960	2756	DllCommonsvc.exe	97
PID 2756 wrote to memory of 2632	2756	DllCommonsvc.exe	98
PID 2756 wrote to memory of 2632	2756	DllCommonsvc.exe	98
PID 2756 wrote to memory of 2632	2756	DllCommonsvc.exe	98
PID 2756 wrote to memory of 1464	2756	DllCommonsvc.exe	100
PID 2756 wrote to memory of 1464	2756	DllCommonsvc.exe	100
PID 2756 wrote to memory of 1464	2756	DllCommonsvc.exe	100
PID 2756 wrote to memory of 2612	2756	DllCommonsvc.exe	101
PID 2756 wrote to memory of 2612	2756	DllCommonsvc.exe	101
PID 2756 wrote to memory of 2612	2756	DllCommonsvc.exe	101
PID 2756 wrote to memory of 2652	2756	DllCommonsvc.exe	102
PID 2756 wrote to memory of 2652	2756	DllCommonsvc.exe	102
PID 2756 wrote to memory of 2652	2756	DllCommonsvc.exe	102
PID 2756 wrote to memory of 2732	2756	DllCommonsvc.exe	104
PID 2756 wrote to memory of 2732	2756	DllCommonsvc.exe	104
PID 2756 wrote to memory of 2732	2756	DllCommonsvc.exe	104
PID 2756 wrote to memory of 2792	2756	DllCommonsvc.exe	106
PID 2756 wrote to memory of 2792	2756	DllCommonsvc.exe	106
PID 2756 wrote to memory of 2792	2756	DllCommonsvc.exe	106
PID 2756 wrote to memory of 1340	2756	DllCommonsvc.exe	108
PID 2756 wrote to memory of 1340	2756	DllCommonsvc.exe	108
PID 2756 wrote to memory of 1340	2756	DllCommonsvc.exe	108
PID 2756 wrote to memory of 2188	2756	DllCommonsvc.exe	111
PID 2756 wrote to memory of 2188	2756	DllCommonsvc.exe	111
PID 2756 wrote to memory of 2188	2756	DllCommonsvc.exe	111
PID 2756 wrote to memory of 2872	2756	DllCommonsvc.exe	114
PID 2756 wrote to memory of 2872	2756	DllCommonsvc.exe	114
PID 2756 wrote to memory of 2872	2756	DllCommonsvc.exe	114
PID 2756 wrote to memory of 2924	2756	DllCommonsvc.exe	115
PID 2756 wrote to memory of 2924	2756	DllCommonsvc.exe	115
PID 2756 wrote to memory of 2924	2756	DllCommonsvc.exe	115
PID 2756 wrote to memory of 1948	2756	DllCommonsvc.exe	116
PID 2756 wrote to memory of 1948	2756	DllCommonsvc.exe	116
PID 2756 wrote to memory of 1948	2756	DllCommonsvc.exe	116
PID 2756 wrote to memory of 3040	2756	DllCommonsvc.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f00adb90778b2f88c4e615a7024bc64c8039437f51e00027fec532d1f61680e4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\fr-FR\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\de-DE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nst6gikYeE.bat"
        5⤵
        
        PID:536
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:540
      - C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bGwFtC02oQ.bat"
        7⤵
        
        PID:1588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1760
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat"
        9⤵
        
        PID:1716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1832
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FIx4sKIZfl.bat"
        11⤵
        
        PID:716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1492
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"
        13⤵
        
        PID:1416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1044
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uSuCPwp4Rh.bat"
        15⤵
        
        PID:1752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:580
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat"
        17⤵
        
        PID:2864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2020
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat"
        19⤵
        
        PID:2340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:680
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat"
        21⤵
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:604
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat"
        23⤵
        
        PID:1076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2740
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat"
        25⤵
        
        PID:2860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1324
        
        C:\Users\Public\Desktop\winlogon.exe
        
        "C:\Users\Public\Desktop\winlogon.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Registration\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Registration\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Desktop\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Desktop\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\L2Schemas\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\DVD Maker\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\DVD Maker\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7b51ec29f1777c4e3af3d095f7b958e

SHA1
a035cdb2a8aa4805485dc90de332050ad363f7f4

SHA256
d3976f11bfe652d5ba3495531fbb12e7a869d479217c942fbab24c8d31ccba78

SHA512
ce95aff114b53cef30041a87c8fe488c9f73abc8f000cbe16da3b9e002f076329bb7df06cc1ee18570834a88796078ea2e333afb8a7cda394e4d0747b5a09f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a321182a1b77210ce00702910c0f2b2

SHA1
257f1312c39f936b4407e31244f5aac3ed69ce96

SHA256
fe649cf96bb55da56d7a9608c4aaff5a3a31e2a90d844bb8acdfafb7057fb0be

SHA512
0e5d0623324eebe621e7dcdea6e04cb3668a45cb215dc5acfaf6aba88b2d0834c9093b014077b410f6bbca1163dd7b57ffda3288eb6c7c6a6549e2ddbd589fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b710f93ec9560614772e6c3acc8fe48

SHA1
84c3302700252e2ade6605d853a7e49a7103dc37

SHA256
054c636cebf13aaabc1a0f7c824411c5b4adaea93b7c22df31162bc5b9dc1cc1

SHA512
a59ffba460ce274b83d9bd64a01670eb07a0993c0b9db8dbfaa897df870b5ccd66995c2129064c5e76a5ec12868fe5fb944245282ea986a931bbc89bd62ac40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad5fedad2bde846cec3f53a588ce1ca

SHA1
b345324b7e6d65fd8ffee36a4bcaa207fbf609c4

SHA256
643ad28cc0baf0af9b764e67bac0f99bba38f9ba0cd928d6d4ef5fc396c49f1d

SHA512
f293d94b97ad1c3ffc4191a7ffc11ef7793ff0b804661254a40feb528a918147692cb30fe1fdf547c2d4e6835be543525d5e305b72132f814fa10f2bbefef7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0f735015d98ccf96fac3b664dc0ed2e

SHA1
48f936a4922757cc1f3a97561997938036e1fda5

SHA256
197ae7f1aa824d6cb368342109aa06d95b5e015c70865c9b1e00d6d2a5d9900c

SHA512
2de7dd77b7b304cc84bf87c386ed7cd23aa963da0588bf9d40cf9bbb39df7c54ad56e0c4bd4e0c4f35011b7b64da3527311101bdf912a0a21be1b9fe412f278a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
006142be3f3789e29266bfdc6fc04874

SHA1
e8c1a036cfd980c2458b3bdbd6167ff0a57559ea

SHA256
ed1affbd1d4932dde18d86f6db5fd2c25f38c690d9610589b8ff90d82536512d

SHA512
d024cc161012cbfef5e8909bb1d5cf51bd849791258f5445ff1a68cda16f534a19b59acab5cd45a8a95ba1e670640cc8cadd8b3ebc01aed3a04c2a6b0d6ae027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4565a2ae7dcb0c916deb01aaf167d170

SHA1
a9569d3d79c0a4e46d0d037f70b89d1ae498428b

SHA256
5091b170e3933f7c6dfa93c1a48210a3a7109b444dea250b8dc36d06bfca0415

SHA512
45b77ab906fc3522d203e2d6346719d24f418d3a15c9c0cc8dff8bda5e8353311703449292ed653a698f79cf3bdb160c6ffcc4d30574c82ad64aa03fe4458e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a89fb441c07d12f0a96b4227ccb7ab0a

SHA1
9cd12de7d6ca743ede00e825710c0e94d26d81c4

SHA256
31395355d206cb2401930744de86d2c99a0a0b30d3ba14719b51e2065890d353

SHA512
8b666cb7212006a79cb1240789acce7c372f3e5682e83932a4f0c3aa177829101806f0a65cd88b3fbe0c6c0b83b69446884ddcdacd6a2eb5119d0d2f70be3330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91169dd5d5de0beda4c2c668f9c3e4cb

SHA1
1cac445932f28c8be5b026f40252df92f149c46e

SHA256
002503a102099698794c8e2c6470a112af853158bedf3adae6b5c48d54ad20a3

SHA512
78d5dd0615c1079c65b6b252170b78aa6ba317a12de6b34b24cf98dc1d6d31954771ef34ce5fecb72b97dcc872f478945b4435bbbc71d7a214e503e057d19ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE7C2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FIx4sKIZfl.bat

Filesize
201B

MD5
261103b5dfeb4cc285d6b1432416e248

SHA1
e67ff459bfbee09ba1e4138ce3bec4170126929a

SHA256
802ceea60df83f667dbabc59d9536ca8e294103425e495c91397247a5d65f32e

SHA512
96a8ffd061218f5558e17e8e1a2c48e518adb7bea9e41f4872ae47c9b62db9cc3948bca26f75efb81626d9a3e843273599e85777d2f6b482ed56aa065c152844

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat

Filesize
201B

MD5
c149eefebb955ff0b6ff75df646ee0dd

SHA1
69aee965600d38f05490c4df892af4ab132640e6

SHA256
50f21f9852b8da157bd1a7ebcf30fc09d4159fcafbfa79de057eb7d55a21a346

SHA512
2aff4360045f3aad1027079746e8f83e2140917d21364205235cc0d235dd4956d810afe1bcc089d6e0da16bd1d698c2d3471282e21515f261f37f2ab57d0e239

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nst6gikYeE.bat

Filesize
201B

MD5
fe44b64354e68c6bb7de730a6e40a938

SHA1
305322d67e6915907a3d2aafffc6742882ea7cd5

SHA256
5eb57ea06f7fa3955322928a2e7ce5cbd3418845cc97aac66c39c2ebf5cb6b45

SHA512
79d6a43bee84142e757e55d1d88582a4e05ef162d8b817c942b210577abef69594a9d220bf6ffa9125f9b928f888b19e902987fab7d76c1f3ae76335551dbc38

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7D5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat

Filesize
201B

MD5
bb6db06948773ae19903d25f2d381b87

SHA1
c1a626473815623819c052c2635b016607ddfb99

SHA256
c24248ff9ebccb16d7cd474483c120f976809ce87042c3f93e59f9195c4c0983

SHA512
9ea606761599cf667f6745185b5610534c7c82da30c253db263b42cee2bb70aaa2c04b41fd3b3d802f3c154b9e9e60a1574eafdb345eead83ff055125f054376

Download Submit
C:\Users\Admin\AppData\Local\Temp\bGwFtC02oQ.bat

Filesize
201B

MD5
81675a3ca6b7fd700de5c9f6c5941785

SHA1
95f34e6c0106890185d5cfc5d6c6178d30004e0c

SHA256
5643b3d113178214f1b9d23e7b672cd1644808fcc7f359d95765fbdbab3f4fd9

SHA512
277f6364abe4a8dfd565e70f107128dbd4d32af2d7b0aeb273d847e418cc4b34e225ed20576d488211b2f8490df4e682c478c58adaec5522b56d11f4572ef1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat

Filesize
201B

MD5
75ba1e67e21c051771721c14df5dabcc

SHA1
9ec190166d00aec1e0c8342219188cd078b46338

SHA256
6738b6a6091e007591a37f8b520d4aa99d645a99d45c8e855b3c094dc8411bf5

SHA512
ffcdbc3e59fcb3102c097db8ed61af9500fcc5e020cfb79ad59c82863ed9a8386117772a5752c2bd8cbeca28c609d190ee8e497c6902de565d3b808b0f684ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat

Filesize
201B

MD5
be9472c03aa2b40909309e95db859a79

SHA1
675c0c7540e1a40523258294da7018e3c46b733e

SHA256
3e1429ca8eddda06dc37c8e833596f865c4590e787314af20c06e9694e4328b9

SHA512
eb26616eba371ec76eb69b7257fdc65beb2308398b901dcd1cfe7d1ab74c3a6d9e1782bf4a682f7c5f509f1b1a3360336894a4082632f2fb984e904424bd0a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\uSuCPwp4Rh.bat

Filesize
201B

MD5
b3ae035a9883ffa36d9b61b0651095dd

SHA1
eb859d0be85fc22c78a49682ee7d04f67a583b28

SHA256
3d5ac097d496f1167879755bf9ca997703cb155d8bb2011dc08c109550b59c5a

SHA512
a70c5648bd343c4741adcc1dc6eb7c31b716ec74ec7dc0bce2dde4d39ebbd819b9d1a511fdfe984f38933284e5d580d6bbe19ac7b8a0e248e54c535e304a9e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat

Filesize
201B

MD5
16238825dba4b6132be4c3299871610a

SHA1
1876fa2291ec6baf3e6b460b3415452258a57bba

SHA256
3d149c8924965e484bc2760702675d877eee126679efc32e812b3e6ba9000b8a

SHA512
57329de0f704e4a23b09a55db97bdae1f973080915c7ea7ddf318ad57d4057f57300311cdd05541fc303207f3a8bf6d97680aeb19dd20f3d18f03f721691502b

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat

Filesize
201B

MD5
1232f8b94174fb5b46481c170cc03675

SHA1
6ac7e57247c9a86815b35a4f7c4cfca73b701848

SHA256
c2406d40c2360e17c756d45aacd384a86f9928e647a2d0de6bdbbd289e4abb57

SHA512
25fb9735a25eaf11545c7b83f6f69516924e137cd91616817502ad7cd2268105468deb788f3fa581aa563bcb29d7b7342ba64a3c2523e9ed9be8bffc753d363e

Download Submit
C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat

Filesize
201B

MD5
92174319377914dd453054fb2ad5bfc2

SHA1
d3d5e3ef1b78585fc35735bf2722801e9304d7dd

SHA256
de42d7c5fc1d59c3c198a6d25a689a1400f160ed5b7cdb1d26c2e606aefea7b8

SHA512
51b41be2b2310892538e04322ffd3f5e3ef4bb4ea112529bd0affd624e3ed19a08a01fc130218874fa4a36a2f667aa7b31d2dbe53eddb408589f4d0eedf4ed92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
40c6b0134cf69a8ada8478519730b1cb

SHA1
4bb514b2e216a278838468d57c70c6dc8c564a4e

SHA256
84eb913cada8014f9debb4dd9e54828fc674362d1b036621468d2d28ae43e074

SHA512
1074963bf6e2449645c0b51f10fb6f7a1b27dc165315f00b8ad0c335b7a1919113b77048fc33d687d1c1c2df393b6b8e6d341cebea44a1c192e7a093a5d71a64

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1340-214-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1340-213-0x0000000001150000-0x0000000001260000-memory.dmp

Filesize
1.1MB

Download
memory/1560-515-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/1740-335-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/1816-755-0x0000000000CA0000-0x0000000000DB0000-memory.dmp

Filesize
1.1MB

Download
memory/1816-756-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/1840-635-0x00000000008A0000-0x00000000009B0000-memory.dmp

Filesize
1.1MB

Download
memory/1920-275-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1920-274-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download
memory/2004-455-0x0000000000A70000-0x0000000000B80000-memory.dmp

Filesize
1.1MB

Download
memory/2632-695-0x0000000000B80000-0x0000000000C90000-memory.dmp

Filesize
1.1MB

Download
memory/2652-78-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2652-72-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2756-13-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2756-17-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/2756-16-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2756-14-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2756-15-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2840-395-0x0000000000260000-0x0000000000370000-memory.dmp

Filesize
1.1MB

Download
memory/2900-575-0x0000000000170000-0x0000000000280000-memory.dmp

Filesize
1.1MB

Download
memory/2968-154-0x0000000000270000-0x0000000000380000-memory.dmp

Filesize
1.1MB

Download