dcrat | 77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940

Analysis

max time kernel
145s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe
Size

1.3MB
MD5

09147f35687e5ea42e2d130bc5f8eb90
SHA1

1ed4b7c557e662431e2f929e80e967dfa62a4f26
SHA256

77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940
SHA512

02f3857bbe5c06b1ead05b36dc324e3687104097dcfeb3948aadbf912e872cee0322c25c6f050ac20b8adfb02e72655e0eb795acd4b6bcc73c155a27a02dfeae
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2612	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2612	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000192a9-12.dat	dcrat
behavioral1/memory/2192-13-0x0000000001050000-0x0000000001160000-memory.dmp	dcrat
behavioral1/memory/2632-60-0x0000000000C70000-0x0000000000D80000-memory.dmp	dcrat
behavioral1/memory/2900-216-0x0000000000290000-0x00000000003A0000-memory.dmp	dcrat
behavioral1/memory/2960-276-0x0000000001080000-0x0000000001190000-memory.dmp	dcrat
behavioral1/memory/2392-336-0x00000000002D0000-0x00000000003E0000-memory.dmp	dcrat
behavioral1/memory/2736-397-0x00000000010C0000-0x00000000011D0000-memory.dmp	dcrat
behavioral1/memory/2736-635-0x0000000001180000-0x0000000001290000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2828	powershell.exe
2896	powershell.exe
2040	powershell.exe
2816	powershell.exe
2892	powershell.exe
2620	powershell.exe
2028	powershell.exe
2572	powershell.exe
848	powershell.exe
2228	powershell.exe
2904	powershell.exe
2772	powershell.exe
2684	powershell.exe
2536	powershell.exe
2928	powershell.exe
2752	powershell.exe
2884	powershell.exe
2888	powershell.exe
2840	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2192	DllCommonsvc.exe
2632	dllhost.exe
2900	dllhost.exe
2960	dllhost.exe
2392	dllhost.exe
2736	dllhost.exe
2976	dllhost.exe
2316	dllhost.exe
692	dllhost.exe
2736	dllhost.exe
1624	dllhost.exe
2668	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
352	cmd.exe
352	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
33	raw.githubusercontent.com
5	raw.githubusercontent.com
22	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\b75386f1303e64	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\DataStore\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\DataStore\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\AppCompat\Programs\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\AppCompat\Programs\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Windows\AppCompat\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\AppCompat\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\Fonts\taskhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
2656	schtasks.exe
388	schtasks.exe
3052	schtasks.exe
2164	schtasks.exe
2224	schtasks.exe
572	schtasks.exe
1236	schtasks.exe
2256	schtasks.exe
1904	schtasks.exe
2640	schtasks.exe
1652	schtasks.exe
908	schtasks.exe
2424	schtasks.exe
1696	schtasks.exe
1468	schtasks.exe
324	schtasks.exe
2484	schtasks.exe
2608	schtasks.exe
2996	schtasks.exe
564	schtasks.exe
2520	schtasks.exe
2988	schtasks.exe
2468	schtasks.exe
1404	schtasks.exe
2000	schtasks.exe
3060	schtasks.exe
2280	schtasks.exe
1636	schtasks.exe
2172	schtasks.exe
2080	schtasks.exe
2188	schtasks.exe
2356	schtasks.exe
2664	schtasks.exe
3028	schtasks.exe
2348	schtasks.exe
1692	schtasks.exe
1352	schtasks.exe
1968	schtasks.exe
2308	schtasks.exe
992	schtasks.exe
2064	schtasks.exe
1620	schtasks.exe
3064	schtasks.exe
1660	schtasks.exe
1924	schtasks.exe
1528	schtasks.exe
2628	schtasks.exe
2632	schtasks.exe
2076	schtasks.exe
956	schtasks.exe
2796	schtasks.exe
1936	schtasks.exe
2320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2192	DllCommonsvc.exe
2192	DllCommonsvc.exe
2192	DllCommonsvc.exe
2192	DllCommonsvc.exe
2192	DllCommonsvc.exe
2816	powershell.exe
2928	powershell.exe
2840	powershell.exe
2772	powershell.exe
2040	powershell.exe
2536	powershell.exe
2572	powershell.exe
2632	dllhost.exe
848	powershell.exe
2752	powershell.exe
2620	powershell.exe
2904	powershell.exe
2892	powershell.exe
2888	powershell.exe
2228	powershell.exe
2828	powershell.exe
2684	powershell.exe
2896	powershell.exe
2028	powershell.exe
2884	powershell.exe
2900	dllhost.exe
2960	dllhost.exe
2392	dllhost.exe
2736	dllhost.exe
2976	dllhost.exe
2316	dllhost.exe
692	dllhost.exe
2736	dllhost.exe
1624	dllhost.exe
2668	dllhost.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	DllCommonsvc.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2632	dllhost.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2900	dllhost.exe
Token: SeDebugPrivilege	2960	dllhost.exe
Token: SeDebugPrivilege	2392	dllhost.exe
Token: SeDebugPrivilege	2736	dllhost.exe
Token: SeDebugPrivilege	2976	dllhost.exe
Token: SeDebugPrivilege	2316	dllhost.exe
Token: SeDebugPrivilege	692	dllhost.exe
Token: SeDebugPrivilege	2736	dllhost.exe
Token: SeDebugPrivilege	1624	dllhost.exe
Token: SeDebugPrivilege	2668	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2104	2348	JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe	30
PID 2348 wrote to memory of 2104	2348	JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe	30
PID 2348 wrote to memory of 2104	2348	JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe	30
PID 2348 wrote to memory of 2104	2348	JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe	30
PID 2104 wrote to memory of 352	2104	WScript.exe	31
PID 2104 wrote to memory of 352	2104	WScript.exe	31
PID 2104 wrote to memory of 352	2104	WScript.exe	31
PID 2104 wrote to memory of 352	2104	WScript.exe	31
PID 352 wrote to memory of 2192	352	cmd.exe	33
PID 352 wrote to memory of 2192	352	cmd.exe	33
PID 352 wrote to memory of 2192	352	cmd.exe	33
PID 352 wrote to memory of 2192	352	cmd.exe	33
PID 2192 wrote to memory of 2684	2192	DllCommonsvc.exe	89
PID 2192 wrote to memory of 2684	2192	DllCommonsvc.exe	89
PID 2192 wrote to memory of 2684	2192	DllCommonsvc.exe	89
PID 2192 wrote to memory of 2536	2192	DllCommonsvc.exe	90
PID 2192 wrote to memory of 2536	2192	DllCommonsvc.exe	90
PID 2192 wrote to memory of 2536	2192	DllCommonsvc.exe	90
PID 2192 wrote to memory of 2928	2192	DllCommonsvc.exe	91
PID 2192 wrote to memory of 2928	2192	DllCommonsvc.exe	91
PID 2192 wrote to memory of 2928	2192	DllCommonsvc.exe	91
PID 2192 wrote to memory of 2028	2192	DllCommonsvc.exe	92
PID 2192 wrote to memory of 2028	2192	DllCommonsvc.exe	92
PID 2192 wrote to memory of 2028	2192	DllCommonsvc.exe	92
PID 2192 wrote to memory of 2572	2192	DllCommonsvc.exe	93
PID 2192 wrote to memory of 2572	2192	DllCommonsvc.exe	93
PID 2192 wrote to memory of 2572	2192	DllCommonsvc.exe	93
PID 2192 wrote to memory of 848	2192	DllCommonsvc.exe	94
PID 2192 wrote to memory of 848	2192	DllCommonsvc.exe	94
PID 2192 wrote to memory of 848	2192	DllCommonsvc.exe	94
PID 2192 wrote to memory of 2040	2192	DllCommonsvc.exe	95
PID 2192 wrote to memory of 2040	2192	DllCommonsvc.exe	95
PID 2192 wrote to memory of 2040	2192	DllCommonsvc.exe	95
PID 2192 wrote to memory of 2228	2192	DllCommonsvc.exe	96
PID 2192 wrote to memory of 2228	2192	DllCommonsvc.exe	96
PID 2192 wrote to memory of 2228	2192	DllCommonsvc.exe	96
PID 2192 wrote to memory of 2828	2192	DllCommonsvc.exe	97
PID 2192 wrote to memory of 2828	2192	DllCommonsvc.exe	97
PID 2192 wrote to memory of 2828	2192	DllCommonsvc.exe	97
PID 2192 wrote to memory of 2896	2192	DllCommonsvc.exe	98
PID 2192 wrote to memory of 2896	2192	DllCommonsvc.exe	98
PID 2192 wrote to memory of 2896	2192	DllCommonsvc.exe	98
PID 2192 wrote to memory of 2816	2192	DllCommonsvc.exe	99
PID 2192 wrote to memory of 2816	2192	DllCommonsvc.exe	99
PID 2192 wrote to memory of 2816	2192	DllCommonsvc.exe	99
PID 2192 wrote to memory of 2752	2192	DllCommonsvc.exe	100
PID 2192 wrote to memory of 2752	2192	DllCommonsvc.exe	100
PID 2192 wrote to memory of 2752	2192	DllCommonsvc.exe	100
PID 2192 wrote to memory of 2892	2192	DllCommonsvc.exe	101
PID 2192 wrote to memory of 2892	2192	DllCommonsvc.exe	101
PID 2192 wrote to memory of 2892	2192	DllCommonsvc.exe	101
PID 2192 wrote to memory of 2904	2192	DllCommonsvc.exe	102
PID 2192 wrote to memory of 2904	2192	DllCommonsvc.exe	102
PID 2192 wrote to memory of 2904	2192	DllCommonsvc.exe	102
PID 2192 wrote to memory of 2772	2192	DllCommonsvc.exe	103
PID 2192 wrote to memory of 2772	2192	DllCommonsvc.exe	103
PID 2192 wrote to memory of 2772	2192	DllCommonsvc.exe	103
PID 2192 wrote to memory of 2884	2192	DllCommonsvc.exe	104
PID 2192 wrote to memory of 2884	2192	DllCommonsvc.exe	104
PID 2192 wrote to memory of 2884	2192	DllCommonsvc.exe	104
PID 2192 wrote to memory of 2888	2192	DllCommonsvc.exe	105
PID 2192 wrote to memory of 2888	2192	DllCommonsvc.exe	105
PID 2192 wrote to memory of 2888	2192	DllCommonsvc.exe	105
PID 2192 wrote to memory of 2620	2192	DllCommonsvc.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77f56621b2b92074399af7d6cf907363c3c16d0fa39cb56e1377cef623cd4940.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\DataStore\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\fr-FR\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppCompat\Programs\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppCompat\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
    - - C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        6⤵
        
        PID:576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2712
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1lJXnITmE.bat"
        8⤵
        
        PID:2536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1864
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat"
        10⤵
        
        PID:2940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1568
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat"
        12⤵
        
        PID:1964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2532
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPH1A2PBmS.bat"
        14⤵
        
        PID:2964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1400
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat"
        16⤵
        
        PID:2876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1428
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
        18⤵
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat"
        20⤵
        
        PID:992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2640
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"
        22⤵
        
        PID:2756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2148
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat"
        24⤵
        
        PID:1404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2928
        
        C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Windows\Fonts\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Fonts\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\SoftwareDistribution\DataStore\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\SoftwareDistribution\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\AppCompat\Programs\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\AppCompat\Programs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\AppCompat\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\AppCompat\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\AppCompat\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5c61d0e5c4bb6f9e5ab16c11c08646a

SHA1
89a90e0f86828794501ce1df288ee50ca73c128e

SHA256
c5519b28ad947db05efae5820b475eee5942b851d89038094910fd27fa14c19c

SHA512
0d21b519808f8db775f1e4541f355c8e6a514c2921498e6cf1b8e32ce3db5fed3694a3fa02b8f9e218a87cd8f933a75f70be694a5bd35d3b646e3e44df04424d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98b36cfc8041e34ff62551efbe2e7a7a

SHA1
fcdb9d6d834c7afff1e785a73da4bf7da3ebd274

SHA256
9d2da65e8ec2b2ad34a1b0f4b3cca0615359a568f412ae57f8feb15d23322424

SHA512
19f21e11e39e4404a7a654b57a66433855a34fdb27afb5ec1cfac3ed950a0acd2bef700d6e285bd6a03124120f3cf0261361adc292e9bdd039c7250a706c8f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb8535632e4d20d180b09476b0e445d

SHA1
3de35b4e8bef03310cc623723c9f144605e222c6

SHA256
f0956633374537c724ba83c6b6f25edafefe46623bf62ede510d72a3c572fa60

SHA512
dd7a6343aeed0dac55669d10fc14f8ebb3ebf950808d8960b08ad05ee8330703734a06a686b247e7a1558b62def629064b136f579f9730dbfe3cc7427fa2316f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f3b414b64156aef6aa274d212c1b107

SHA1
108b26360fe36994ae6773acc23df8c0758fa8c7

SHA256
ce1d544010ec16d6938df67280bbcfe3a3e8270057997b3bb4397b427b4f609e

SHA512
072f60bf7e27ad18055bdee58287a69ae916adcd25c3ab48ec03db09228f408b839c82b853e3387d4c9bff4ace7338cc782ecec1ca9c0ed24b13dd820e826cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b01dbe275e9a3f2e6235983c64d126f

SHA1
2cfb3a293cb74dbda87beaa9fc289b7fc771e608

SHA256
f3dca0a25074553f7873bb54a050ea0c55f2faa121e8ea176567cd993e3780d1

SHA512
9edb8bd51a623c86e4f3d8b92a6f3906a7eec5d1038a1ae63a34aa9cc9062b4e763f5385fbdbd75ae84fe0b76af3bf13169501b5c5bfb99274726ec201f591b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38e84ae14eace917914a5ce9c8f755b6

SHA1
517c31e7655db7409f963c3bbfe0d6549d2bef6e

SHA256
c86cca64f1e39ffb17493269e6ba2752c1b7f921d496e088023f865dbdf44430

SHA512
23a7dc92beffea2b80f1300dd53d207718175847842e205cf8ec6490fe8bd053a4562a397dae10fd57d26fad677257a58b50b24cc8100218d7348b5c637eb3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
919ddfea47b00660149b0c2b9f240557

SHA1
df65235e6727e1a3f0606c5998bc6498dbbc3ac2

SHA256
39da324608b2f0cec03ae71a6821f5a278be7c78def8977d01c773584c9165e8

SHA512
b945c4134aed40dbe9669b5e072ce4617186eef9a2b3279f3644c75b09d9d9ce646306355ed52c8416fb224439f941fde3adf2998d4667199505abff842b9a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20e7aa31024b06c24ca6e1e83c7bc9e8

SHA1
310369bdf6c485cd40be93d4f525874bca1f180d

SHA256
ae459cbcbde12d5d99387f56441fc7dbadb81f00bc8129df0888678dcb312624

SHA512
e2d742fb27d49146abad25a8bc042759928e6c72c809effe28f499b20fb284699def0b6a63a7ddaceff2ca8cef399d0f18bde09be52ac691e4f696dfc2bf5683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44dae8f65bffee767bf64356b6bf0caa

SHA1
7e9789e6d4050691257a8196c5fb6e88b30884f4

SHA256
5796412c13056dfe7bd13f988e367dd8743ba677c6931feaf539a3f1c805a153

SHA512
2e3737ea5df6431a3a851fc782c3b763b1f1322df67636b6ee968b6a0a7058d8b6ed46db3385db3ca45352c3845d07903e2c25770cc946a1907999076054fe83

Download Submit
C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat

Filesize
224B

MD5
f491680eb82ef3a251cb6c8fcf08fcba

SHA1
ac6537eb016dd2d108323ee4f3083e9c8b217e06

SHA256
1c8d067a7de507e461e0fb794a29d9b3a4d039e554d2185d86283a8351ca38d1

SHA512
20d453d95d714ce7ec46a767bad091b8a76f5d75afde9ce40c6243ac5ffd6a880ddf2861e0ed2ebe7d3d5a9eaa42957052473592e55e481e16cd480bf9f8a4c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat

Filesize
224B

MD5
0d44bb446b1a3178857176dc830df1b4

SHA1
7af13e6a91c2e3beb56914fe073aedacaa5b381c

SHA256
fd51ef6dadbce27c4c08f04022dd90dc092d7c40c37e46ba1caea7a598ab3919

SHA512
3cdf04317695168a12aeeabd2cec3dc29d16ef954c351afd0e0c76d43e96cbeba773956fe76443d206a9ec4a5959da96c6f92bf8f6f7b5a7790c46ec099e750e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA89.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat

Filesize
224B

MD5
a97c9506eebdaf57da17db650ccd1f77

SHA1
bd6f7276841434b2057967cfaeed6c0f13231035

SHA256
7b0cc888f7c0eb0c8bbee310b7580043e65ccc0f8c069c844d327032bee8c8af

SHA512
4dc7661a2d07355f89cecd9a5ad8b778fed8865f785b58d115e83a0c3e18cb00473ec5b6803e4d809c807613cf832b1b60c519220221f383bb382516f5b38e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\OPH1A2PBmS.bat

Filesize
224B

MD5
cb32ca06e0b1d3cc982763a856ccc2c6

SHA1
a8c7a31a83fdc426fc78ce002ea0edb11a143028

SHA256
5455b4014a0e0289b62e7d7cc9cc04733c66f363b343ed3be3066bb5c8170980

SHA512
9748ee37ff0a58a1c52980180bbab37ddd65f400818ff545288252165a27f857fcb08a5a34c7660bf2314c4018357b5500b8b581f99f8214676347aad597a621

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDAAB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat

Filesize
224B

MD5
b3fe89ad242c11181efa2dc47cf65ec9

SHA1
afcc43c4c577b6dbd79abc671818cd1a81f88ddb

SHA256
12c433af64758e546ad400df7f72f3d642733ecaf4b5ae61e95765deeff99335

SHA512
06c8eedfa9aaf6437e6333d010cb6bf584898f2def89c1f73bd647e842d086547595a019f9f581f566fcdad7630b343b0eb181ce059c90b73417208a15c96326

Download Submit
C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat

Filesize
224B

MD5
f6954bd8e109a69e9555ebcdac7dd081

SHA1
5b03e6f6696ff7423549b9705491e7c9e2d4554d

SHA256
a09a0d565355cf1ba41a06d2f84c1e276ca52743f14b21795ab22d11d55c4bce

SHA512
f7a3bdddeee52b1ea4a6a7a4d38355f0b697b173aa629332a74880cbf04088021d7ae1f13d81339b605bbdfe0ee6facfc56abda0a5d82ad526711328e26b63ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1lJXnITmE.bat

Filesize
224B

MD5
1bfb5ad6d65e7e7957e62bc0f7227ae2

SHA1
a3669f5e1ef5024f0f1f13ca098469d832a20c72

SHA256
b6c073de507ec39b40a5df3a6f553cf58846be9ec96d2d11c7465220f1e64f52

SHA512
d47d771d78c2b4f8e9ef374d26a581577860bc98bbd6749c354ab0a58e11363e3dee40870cb4768b9c7597be51cb00630ad00c3f9b14acd5c60f51744d6c6fb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat

Filesize
224B

MD5
e1f04f0c68a3c704ddcf077f1f315e55

SHA1
8d600ee9c87bd16e2a1cb3454243bd3dd428309c

SHA256
c53eeca987fcab563509b582f898e4ac6533c16bcbbb31296f25f387648a3650

SHA512
8ce834325060361c904df8b9dfe8503c7bd229a5691af4d10d098d700db5cf8b38ce015f1dbdea25afd67f394fc6115900b74ed4180cab35d4c2a3ba2b62bdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat

Filesize
224B

MD5
87735bd6b0a283c14d707bc5afdff460

SHA1
87d4fec7cb8418c014ff44a9b2a9c34830a68996

SHA256
ef1903c0ed2d170b68929489ad0f72fd581e6814f4be9acd0260da20269fba60

SHA512
2233d02bf4373bf28c7c0c29b66f1b46bb77b803053e4e60127c0b777d3140118398960dccac43dcbddd5300e70000174e7a0cd8ea5575985c04c947464815ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat

Filesize
224B

MD5
57fbc0509ff9ebf9a25154a0cc3cff4b

SHA1
21d40e370644a67f37b8f42a045759265adc6c94

SHA256
065110d169c209033f39ad0230a9aa6235c03aa00cf9857948a1d3c4aa6100fc

SHA512
9999d40df70fb8f9afc9ccd7856047ff6b2332a3915d8c1adc6474e718e70f5d0dcfadafdadfb906cf4074947a0f78a560bf8d1ae8fcfe9a537e2e91f3397d9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
822c2f1670461be781677a94e9250472

SHA1
32a4f2bcfe21aad536927ef4f652afb5e1a9d00c

SHA256
7939bc0da888c543fda275f410167f72c2f842e5cabd197960b8a7948b14a8e1

SHA512
72af8f0478c5ac8b2ff486b8154f6af09f170505fb7f6288eeb7acfb70f09fafb19ab415bd2f1d75d90696103518f32c769a60349a7a4c2d398bd676f2a9c4b5

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2192-17-0x0000000000780000-0x000000000078C000-memory.dmp

Filesize
48KB

Download
memory/2192-15-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2192-14-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/2192-13-0x0000000001050000-0x0000000001160000-memory.dmp

Filesize
1.1MB

Download
memory/2192-16-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2392-336-0x00000000002D0000-0x00000000003E0000-memory.dmp

Filesize
1.1MB

Download
memory/2392-337-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2632-97-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2632-60-0x0000000000C70000-0x0000000000D80000-memory.dmp

Filesize
1.1MB

Download
memory/2736-398-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/2736-397-0x00000000010C0000-0x00000000011D0000-memory.dmp

Filesize
1.1MB

Download
memory/2736-635-0x0000000001180000-0x0000000001290000-memory.dmp

Filesize
1.1MB

Download
memory/2816-71-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/2900-216-0x0000000000290000-0x00000000003A0000-memory.dmp

Filesize
1.1MB

Download
memory/2928-70-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2960-276-0x0000000001080000-0x0000000001190000-memory.dmp

Filesize
1.1MB

Download