dcrat | 52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e

Analysis

max time kernel
147s
max time network
143s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe
Size

1.3MB
MD5

42fee122b2024a682587008de944366c
SHA1

4264c7f0e4eb9f5702b97fecb19323612c150e42
SHA256

52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e
SHA512

b2c12ef337008e59cc4dd1310062cab37bca4255472c877c4f5a41960e7f8a0a262d02352f53ad369288d1a5fbb7e02371075616bf1b8337884095173ea5ee0f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2752	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2752	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00060000000186bf-10.dat	dcrat
behavioral1/memory/2700-13-0x0000000000D00000-0x0000000000E10000-memory.dmp	dcrat
behavioral1/memory/380-162-0x0000000001070000-0x0000000001180000-memory.dmp	dcrat
behavioral1/memory/2076-221-0x00000000013E0000-0x00000000014F0000-memory.dmp	dcrat
behavioral1/memory/2368-459-0x0000000000350000-0x0000000000460000-memory.dmp	dcrat
behavioral1/memory/564-519-0x0000000000870000-0x0000000000980000-memory.dmp	dcrat
behavioral1/memory/2600-579-0x0000000000F50000-0x0000000001060000-memory.dmp	dcrat
behavioral1/memory/2844-639-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/1808-699-0x00000000001C0000-0x00000000002D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2140	powershell.exe
2572	powershell.exe
1496	powershell.exe
1796	powershell.exe
2104	powershell.exe
1324	powershell.exe
1104	powershell.exe
2040	powershell.exe
2988	powershell.exe
2856	powershell.exe
1872	powershell.exe
2744	powershell.exe
2724	powershell.exe
2848	powershell.exe
2080	powershell.exe
764	powershell.exe
1292	powershell.exe
2660	powershell.exe
2904	powershell.exe
3004	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2700	DllCommonsvc.exe
380	wininit.exe
2076	wininit.exe
2504	wininit.exe
3028	wininit.exe
1644	wininit.exe
2368	wininit.exe
564	wininit.exe
2600	wininit.exe
2844	wininit.exe
1808	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2916	cmd.exe
2916	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
15	raw.githubusercontent.com
18	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
22	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\audiodg.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Themes\Aero\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\Resources\Themes\Aero\56085415360792	DllCommonsvc.exe
File created	C:\Windows\IME\IMEJP10\help\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\IME\IMEJP10\help\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2440	schtasks.exe
2408	schtasks.exe
2844	schtasks.exe
2328	schtasks.exe
1704	schtasks.exe
1600	schtasks.exe
1448	schtasks.exe
1936	schtasks.exe
2884	schtasks.exe
1440	schtasks.exe
1032	schtasks.exe
872	schtasks.exe
2104	schtasks.exe
1248	schtasks.exe
2412	schtasks.exe
688	schtasks.exe
1564	schtasks.exe
1620	schtasks.exe
1336	schtasks.exe
924	schtasks.exe
1420	schtasks.exe
2096	schtasks.exe
3056	schtasks.exe
1156	schtasks.exe
1204	schtasks.exe
1508	schtasks.exe
2968	schtasks.exe
1312	schtasks.exe
2060	schtasks.exe
636	schtasks.exe
2688	schtasks.exe
1628	schtasks.exe
796	schtasks.exe
3028	schtasks.exe
320	schtasks.exe
2232	schtasks.exe
1856	schtasks.exe
1304	schtasks.exe
2940	schtasks.exe
1988	schtasks.exe
2780	schtasks.exe
2776	schtasks.exe
2476	schtasks.exe
2592	schtasks.exe
1808	schtasks.exe
1200	schtasks.exe
2156	schtasks.exe
1108	schtasks.exe
1748	schtasks.exe
2956	schtasks.exe
2656	schtasks.exe
2428	schtasks.exe
2960	schtasks.exe
1456	schtasks.exe
2380	schtasks.exe
2528	schtasks.exe
3044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2700	DllCommonsvc.exe
2700	DllCommonsvc.exe
2700	DllCommonsvc.exe
2700	DllCommonsvc.exe
2700	DllCommonsvc.exe
2660	powershell.exe
2080	powershell.exe
2140	powershell.exe
2856	powershell.exe
1796	powershell.exe
1104	powershell.exe
764	powershell.exe
2040	powershell.exe
2904	powershell.exe
2848	powershell.exe
2724	powershell.exe
1496	powershell.exe
1292	powershell.exe
1872	powershell.exe
3004	powershell.exe
2744	powershell.exe
2988	powershell.exe
2104	powershell.exe
1324	powershell.exe
2572	powershell.exe
380	wininit.exe
2076	wininit.exe
2504	wininit.exe
3028	wininit.exe
1644	wininit.exe
2368	wininit.exe
564	wininit.exe
2600	wininit.exe
2844	wininit.exe
1808	wininit.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	DllCommonsvc.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	380	wininit.exe
Token: SeDebugPrivilege	2076	wininit.exe
Token: SeDebugPrivilege	2504	wininit.exe
Token: SeDebugPrivilege	3028	wininit.exe
Token: SeDebugPrivilege	1644	wininit.exe
Token: SeDebugPrivilege	2368	wininit.exe
Token: SeDebugPrivilege	564	wininit.exe
Token: SeDebugPrivilege	2600	wininit.exe
Token: SeDebugPrivilege	2844	wininit.exe
Token: SeDebugPrivilege	1808	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2896	1600	JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe	30
PID 1600 wrote to memory of 2896	1600	JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe	30
PID 1600 wrote to memory of 2896	1600	JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe	30
PID 1600 wrote to memory of 2896	1600	JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe	30
PID 2896 wrote to memory of 2916	2896	WScript.exe	31
PID 2896 wrote to memory of 2916	2896	WScript.exe	31
PID 2896 wrote to memory of 2916	2896	WScript.exe	31
PID 2896 wrote to memory of 2916	2896	WScript.exe	31
PID 2916 wrote to memory of 2700	2916	cmd.exe	33
PID 2916 wrote to memory of 2700	2916	cmd.exe	33
PID 2916 wrote to memory of 2700	2916	cmd.exe	33
PID 2916 wrote to memory of 2700	2916	cmd.exe	33
PID 2700 wrote to memory of 2080	2700	DllCommonsvc.exe	92
PID 2700 wrote to memory of 2080	2700	DllCommonsvc.exe	92
PID 2700 wrote to memory of 2080	2700	DllCommonsvc.exe	92
PID 2700 wrote to memory of 1104	2700	DllCommonsvc.exe	93
PID 2700 wrote to memory of 1104	2700	DllCommonsvc.exe	93
PID 2700 wrote to memory of 1104	2700	DllCommonsvc.exe	93
PID 2700 wrote to memory of 2140	2700	DllCommonsvc.exe	94
PID 2700 wrote to memory of 2140	2700	DllCommonsvc.exe	94
PID 2700 wrote to memory of 2140	2700	DllCommonsvc.exe	94
PID 2700 wrote to memory of 1796	2700	DllCommonsvc.exe	95
PID 2700 wrote to memory of 1796	2700	DllCommonsvc.exe	95
PID 2700 wrote to memory of 1796	2700	DllCommonsvc.exe	95
PID 2700 wrote to memory of 764	2700	DllCommonsvc.exe	96
PID 2700 wrote to memory of 764	2700	DllCommonsvc.exe	96
PID 2700 wrote to memory of 764	2700	DllCommonsvc.exe	96
PID 2700 wrote to memory of 1292	2700	DllCommonsvc.exe	97
PID 2700 wrote to memory of 1292	2700	DllCommonsvc.exe	97
PID 2700 wrote to memory of 1292	2700	DllCommonsvc.exe	97
PID 2700 wrote to memory of 2904	2700	DllCommonsvc.exe	98
PID 2700 wrote to memory of 2904	2700	DllCommonsvc.exe	98
PID 2700 wrote to memory of 2904	2700	DllCommonsvc.exe	98
PID 2700 wrote to memory of 2660	2700	DllCommonsvc.exe	99
PID 2700 wrote to memory of 2660	2700	DllCommonsvc.exe	99
PID 2700 wrote to memory of 2660	2700	DllCommonsvc.exe	99
PID 2700 wrote to memory of 2744	2700	DllCommonsvc.exe	100
PID 2700 wrote to memory of 2744	2700	DllCommonsvc.exe	100
PID 2700 wrote to memory of 2744	2700	DllCommonsvc.exe	100
PID 2700 wrote to memory of 2040	2700	DllCommonsvc.exe	101
PID 2700 wrote to memory of 2040	2700	DllCommonsvc.exe	101
PID 2700 wrote to memory of 2040	2700	DllCommonsvc.exe	101
PID 2700 wrote to memory of 2724	2700	DllCommonsvc.exe	102
PID 2700 wrote to memory of 2724	2700	DllCommonsvc.exe	102
PID 2700 wrote to memory of 2724	2700	DllCommonsvc.exe	102
PID 2700 wrote to memory of 2848	2700	DllCommonsvc.exe	103
PID 2700 wrote to memory of 2848	2700	DllCommonsvc.exe	103
PID 2700 wrote to memory of 2848	2700	DllCommonsvc.exe	103
PID 2700 wrote to memory of 2104	2700	DllCommonsvc.exe	104
PID 2700 wrote to memory of 2104	2700	DllCommonsvc.exe	104
PID 2700 wrote to memory of 2104	2700	DllCommonsvc.exe	104
PID 2700 wrote to memory of 3004	2700	DllCommonsvc.exe	105
PID 2700 wrote to memory of 3004	2700	DllCommonsvc.exe	105
PID 2700 wrote to memory of 3004	2700	DllCommonsvc.exe	105
PID 2700 wrote to memory of 2988	2700	DllCommonsvc.exe	106
PID 2700 wrote to memory of 2988	2700	DllCommonsvc.exe	106
PID 2700 wrote to memory of 2988	2700	DllCommonsvc.exe	106
PID 2700 wrote to memory of 2856	2700	DllCommonsvc.exe	107
PID 2700 wrote to memory of 2856	2700	DllCommonsvc.exe	107
PID 2700 wrote to memory of 2856	2700	DllCommonsvc.exe	107
PID 2700 wrote to memory of 2572	2700	DllCommonsvc.exe	108
PID 2700 wrote to memory of 2572	2700	DllCommonsvc.exe	108
PID 2700 wrote to memory of 2572	2700	DllCommonsvc.exe	108
PID 2700 wrote to memory of 1872	2700	DllCommonsvc.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Microsoft Shared\ink\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\Aero\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\de-DE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Mahjong\fr-FR\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMEJP10\help\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VbLwVuSec9.bat"
        5⤵
        
        PID:2960
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1204
      - C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat"
        7⤵
        
        PID:2992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1672
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat"
        9⤵
        
        PID:3004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:832
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat"
        11⤵
        
        PID:2304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2100
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pi2dGiCBJ7.bat"
        13⤵
        
        PID:1672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2596
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat"
        15⤵
        
        PID:944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1632
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat"
        17⤵
        
        PID:268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2552
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7Xe7C8pmPD.bat"
        19⤵
        
        PID:1592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1296
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat"
        21⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1944
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JeZnuB4iL9.bat"
        23⤵
        
        PID:2160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1772
        
        C:\Windows\Resources\Themes\Aero\wininit.exe
        
        "C:\Windows\Resources\Themes\Aero\wininit.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Microsoft Shared\ink\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\ink\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\Microsoft Shared\ink\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Application Data\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\Resources\Themes\Aero\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\Aero\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\Aero\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Games\Mahjong\fr-FR\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Mahjong\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\Mahjong\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\IMEJP10\help\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\IME\IMEJP10\help\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\IMEJP10\help\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
207c43ab035e9d841095fcb1f7bbb82b

SHA1
a87f2b99290797d2d6a7c1222a350017057da103

SHA256
73b2adb17ad3bb8f84e549b028ca7d0e5e263f7bd465f3a746ab07f65df31b8d

SHA512
509036ad01ab299b0931548a4944b97beea0312b4986c30a91a0f6226e77e7939c79cc895c161be3010659fb101ffbbabe4152be2cb79ecdc5737dd735ad7d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d328287259bc8ece950c24fc01b135a

SHA1
9332e483bdca775d861612a3943e70bf8bbb17a7

SHA256
8111e566fa92b366f1144a1be9e881de7d4a4124355244ae5ad814ec6d85394e

SHA512
d24e36f9533d33b431e6e682ab9f846fbf45f1c808365e25eed2d99bd51c960381015707a8ddb37e1ac04b895ba9f33237cfb69f919b9118756ba9165eb29571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2097b8801f2b2e8c9223f109e0f6fd

SHA1
32ac5c41c352d34eae9adba30f32aad46a2afb02

SHA256
e95cc2147d1fcc8a963ee9817135abc595a40bf249bff2922dad166418190963

SHA512
27a671036054f2371057128c8114b58be60f18ebffe2a7e1518e2625513532b299c061f2a6ad111c9b9b9cb9d1eab039c80ee746cfb2fd3af6260c9cdfc798ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
016d861053c0c5c1d5ff7ff59b90dcd7

SHA1
f398e8922487447a68b6dfb340e844c83706e600

SHA256
269b27828ffc5af0ccfd133ca3f5973f6d8e4aa1534c7293204ddf723b1baa02

SHA512
cf270d6b60e29fef88391f019fb03490cd195798aca9a5285fc8a80fc72ee052efc7ec284d05f31fc62cb68449812ffa23a0a21174b294f15ec365d88b217e10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e41ca5df81c3a9d1a546510cfb72552a

SHA1
1931e658ad01d02cf54c971f75ba94cb22489aa9

SHA256
b962cfc0f5f1a3070ed1dd99bb63f37656f7ade8503a640af7eff9379f832159

SHA512
0221df830e049f51b5e5eed8de0f91df70ebff74adef5ded527fa8ed479378ddbb01a71456b162e9262a5883ec65efbd123f70ab07a7388f400ee541ab88063c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7d8308e45b0d513429d6270166a08ea

SHA1
84d91996bbc8549e55b8933551fd61e2bb55d94b

SHA256
14184bbc33677456d7ce4838b0d7c63cc68b14171fab8d35751609222ff399b8

SHA512
89279af0739a94862dab39d7d469548c7e624782c0cc487793d7db4f7b8626e56eddac6d30d0d54f9845356f74d8706d1e1e2d34a75ee2c9d05822dba5ecf25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccbe52dcb371afab1af50958457092c1

SHA1
99769b9582aa04176aaaa2d790f4b7db0d28bf7c

SHA256
858955127c94f691af3ed767c6f500ecc01a08bbc5f6a1f7caed072978e96bff

SHA512
694ea40835d19c14c0beb922f9b737858e3b85c1d30fbda7b4a60d5c931159e693ecfd240bcae53e9c0c6b726a2e80532685a5cbdd742a6de910596726b16c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
781ae160275c523dfd185c377be2c252

SHA1
b09aa5c8e438e7ce30698bfaca3aac09ee39f595

SHA256
e646c183e8ca005a3ca6c9df2a283ab045154f11b0c8f52e6bb32940e8e70bb1

SHA512
3404ca65ee21e730340c70b38c86e81730eb8c633b1c579fa1cc799d982e71da279779a549cbb11e6d39ad1c4a921efad9f785408fe87bb9a5dfd9daaccaa4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7Xe7C8pmPD.bat

Filesize
209B

MD5
2b25b8a07406dc1da996ee805a22c897

SHA1
4bc35f94ddf369581824c73ce4dadd6c955fbf85

SHA256
0aab2f18ff125bd3b5ce4872ebddb9c10ea05b60b3089fd1a1f4ae2923c7239b

SHA512
04405ab097d9f450c2428d97b04115d38b65b854b759366cb826b7b0fb34b3381ffd09e948db0925cbd1a73e796310b44f176010dfc91ce5e6936cc40ccd1ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCE87.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat

Filesize
209B

MD5
2911515664cf797c27f6cb464d024558

SHA1
fd87ace71874e4af64f7a9f9cdfedf0b0ad91c1a

SHA256
19efc6f41414c01953cd475179f9ce5f836509b19670e0e7424ade83c9cac846

SHA512
07dedc2fb642d9e22c98a865b17ee6f1f8fef0ebd18028e7ae6caed95c1a8b51f1a86c46696e7814a3ddfd51f947a478e7324d9f241c49edfda95ca07cafdf68

Download Submit
C:\Users\Admin\AppData\Local\Temp\EtrZeLjFvq.bat

Filesize
209B

MD5
7648602c269213dace8509683cc312d4

SHA1
cb9263c74b1319f97326d55c67556a1195a20def

SHA256
c175b14ad460f935138e720a3b9ea541e59cefca70af96f290b269c6ff3590f1

SHA512
7199cff1dacdfcb8942234572e1617e5b5c98bb6caed8cfc41efd7f58708c967cb7a44c9397eab64379db24ca4e260aa4a51911a6d6df7dca303805cabddce87

Download Submit
C:\Users\Admin\AppData\Local\Temp\JeZnuB4iL9.bat

Filesize
209B

MD5
ed4cd270ebf288fb92b2471b22e39295

SHA1
a18235f76d28ca588f99e73c9e0775e069487807

SHA256
5205ed091b96218df651dbeb951f0f926f435de95cb4cc8bbe8572ffbb752448

SHA512
ca30c981d32fdd4dc2fd095c3068f8610562d80b2cbdaf61702d767097dd4c3b8c7b83a7dc4aeddff00b57423c50e67b3467b038287c254e1e57105996744f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat

Filesize
209B

MD5
a41f75e391b5bcc10a65a265ea999f40

SHA1
0149d42fef76031f4d1507df14ed66b7ddf98449

SHA256
6a6a1de242e6453f66b40a1f6de2ba3198f9b21f6f6e9092080dbc507205f319

SHA512
ad7dcb173de2fe6e4d20835666cf631fdcc2f2ff2a0077d47a91a8cc2ad35cedeb74654076e63fc0b639dac2bc62d78cdca1ee75c70cd8fd9973f79661f5153e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pi2dGiCBJ7.bat

Filesize
209B

MD5
3e3f5b762b667e71bd5ce5862bfcfbb2

SHA1
c43216d5668187ed8e8a678c5afeb95a82deb9b2

SHA256
a8328beec8509a2a8d89ec88b2a2ebe4aa8f0cc3c50dc7b0f2f6a3d1aecbd9eb

SHA512
5533faaf68640192fbd3a823f4847e6f1be0b2e280861db0f3267b2ecee2656da09aca2200b2cf45879446960f41bc6d5c1ea90a1c0958d1cc05b1a6c4d7c124

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE9A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VbLwVuSec9.bat

Filesize
209B

MD5
c6b8a2568fb820411d86592f88139211

SHA1
c92d793ed1c8564137ecd145bd737e0155f50790

SHA256
19378787de1a7aea5b62ea7871fd1802867ead4d55a8b08510853bd1aa29e1d9

SHA512
7f26d46c768ba27c12c28af835de8f6a5947453ca1132abb880e3509c86b4a9b10ed0d3954758ad6329252c937e269add857f676a2a2f98dc0ac6aaad8aad9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat

Filesize
209B

MD5
a350a95478ca54077625ec79c3e77de1

SHA1
8be20d7d5202b70aad714118197551c162efb988

SHA256
12bcf7deec5c595612142dec8523cdc3a1f1a54fa6cdf8176575c7b1834c3dc3

SHA512
2d0f59f1d1f9cc7b717e62986acaafb473f4a6f7cb2539dddebbf89136276c40a821a63693f96d3c53da8c954d77a792dc00747ac4cb15b7bf7ef5c1dccf82ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat

Filesize
209B

MD5
e53e39a061683b07c9d6759388ddb8be

SHA1
53c58d7a8ea8040902b390e7a3b7609a69a9b5cd

SHA256
900417e7d8f03bb21c16f5b88c98d87924bba201c240c1236462a7d8540221e0

SHA512
15cadc152c6466c9da4a9a83fc69e425a8d05fbdf49903ee79f767bf5353a7ce4a9336f4f6ff9af14bb9a32da51a93035e7481ccd393a7f435b52172980843f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat

Filesize
209B

MD5
049147a4b2f0df9f3a2bae9a6ebfb935

SHA1
0e182cb91059df917032a1179183da4bbfa8ad13

SHA256
300e3ab63bc28d5d4d3414df00442dbba8972bcf5500ab00af673de54436d024

SHA512
85243d82d009cdd2208fcdd9f0b9b637912e4827dd4e4e027e624bf3994da64ea980b59f53504e447fad3ccf65787bcb98c61e4de87185c0ca4b989e2f6e3e03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B67IY1V22NI5ZANJ88RC.temp

Filesize
7KB

MD5
83fbb4c753497dd8fdc4807a91926218

SHA1
c023fecaa974be3588e36f13cb070d0fb9112e57

SHA256
95ad5643dba4f6f3baa13d8cba0af14cc02930e98407b81487ee4c6080136b08

SHA512
15cac1337ee3e7d228e55a9d326d656f672f2f0e80119ba867b0353c2c6f25818366ccde5b28453168852fc833f3fd5d5a401d4889ff5aa52997c652cf7c4ef1

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/380-162-0x0000000001070000-0x0000000001180000-memory.dmp

Filesize
1.1MB

Download
memory/564-519-0x0000000000870000-0x0000000000980000-memory.dmp

Filesize
1.1MB

Download
memory/1808-699-0x00000000001C0000-0x00000000002D0000-memory.dmp

Filesize
1.1MB

Download
memory/2076-222-0x0000000000B10000-0x0000000000B22000-memory.dmp

Filesize
72KB

Download
memory/2076-221-0x00000000013E0000-0x00000000014F0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-94-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2368-459-0x0000000000350000-0x0000000000460000-memory.dmp

Filesize
1.1MB

Download
memory/2600-579-0x0000000000F50000-0x0000000001060000-memory.dmp

Filesize
1.1MB

Download
memory/2660-95-0x00000000028A0000-0x00000000028A8000-memory.dmp

Filesize
32KB

Download
memory/2700-16-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2700-15-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2700-14-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/2700-13-0x0000000000D00000-0x0000000000E10000-memory.dmp

Filesize
1.1MB

Download
memory/2700-17-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/2844-639-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download