dcrat | f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
Size

1.3MB
MD5

b1d7cd07cae2eb6aba7cf2f227c5003d
SHA1

9172f04fb782a2a927a496bc3c83124ff289dad7
SHA256

f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6
SHA512

e20f021c663f601a9888ed1e9ff76b644c1014f059995fd45a4796aa1842887fd6f7c52bdaa1707470acd41ca7f7dfadd248ac7bd5b1eaaf10780b48cd90834c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	4628	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4628	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b74-10.dat	dcrat
behavioral2/memory/436-13-0x00000000004A0000-0x00000000005B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3748	powershell.exe
1276	powershell.exe
2368	powershell.exe
5064	powershell.exe
980	powershell.exe
3312	powershell.exe
3428	powershell.exe
2904	powershell.exe
884	powershell.exe
2684	powershell.exe
4568	powershell.exe
4700	powershell.exe
3816	powershell.exe
2964	powershell.exe
4504	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 14 IoCs

pid	Process
436	DllCommonsvc.exe
2776	RuntimeBroker.exe
1580	RuntimeBroker.exe
1292	RuntimeBroker.exe
2988	RuntimeBroker.exe
1788	RuntimeBroker.exe
1496	RuntimeBroker.exe
2564	RuntimeBroker.exe
2232	RuntimeBroker.exe
220	RuntimeBroker.exe
1940	RuntimeBroker.exe
4776	RuntimeBroker.exe
428	RuntimeBroker.exe
2004	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
46	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
25	raw.githubusercontent.com
40	raw.githubusercontent.com
49	raw.githubusercontent.com
39	raw.githubusercontent.com
56	raw.githubusercontent.com
43	raw.githubusercontent.com
45	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\unsecapp.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\29c1c3cc0f7685	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\088424020bedd6	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\Media\cmd.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Media\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\Media\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4928	schtasks.exe
3588	schtasks.exe
4656	schtasks.exe
1096	schtasks.exe
4512	schtasks.exe
4704	schtasks.exe
3192	schtasks.exe
2540	schtasks.exe
3868	schtasks.exe
2960	schtasks.exe
4040	schtasks.exe
208	schtasks.exe
1016	schtasks.exe
2820	schtasks.exe
1640	schtasks.exe
4148	schtasks.exe
4536	schtasks.exe
4380	schtasks.exe
4068	schtasks.exe
1560	schtasks.exe
2232	schtasks.exe
4212	schtasks.exe
3540	schtasks.exe
3044	schtasks.exe
1264	schtasks.exe
4336	schtasks.exe
4524	schtasks.exe
1196	schtasks.exe
868	schtasks.exe
3332	schtasks.exe
3148	schtasks.exe
3100	schtasks.exe
4660	schtasks.exe
2172	schtasks.exe
816	schtasks.exe
940	schtasks.exe
2236	schtasks.exe
1696	schtasks.exe
2268	schtasks.exe
2296	schtasks.exe
2984	schtasks.exe
1832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
436	DllCommonsvc.exe
2684	powershell.exe
2684	powershell.exe
2964	powershell.exe
2964	powershell.exe
5064	powershell.exe
5064	powershell.exe
1276	powershell.exe
1276	powershell.exe
4568	powershell.exe
4568	powershell.exe
4700	powershell.exe
3312	powershell.exe
2904	powershell.exe
980	powershell.exe
980	powershell.exe
2368	powershell.exe
2368	powershell.exe
4700	powershell.exe
3312	powershell.exe
2904	powershell.exe
3816	powershell.exe
3816	powershell.exe
3428	powershell.exe
3428	powershell.exe
884	powershell.exe
884	powershell.exe
4504	powershell.exe
4504	powershell.exe
980	powershell.exe
3748	powershell.exe
3748	powershell.exe
3312	powershell.exe
4568	powershell.exe
2684	powershell.exe
2964	powershell.exe
1276	powershell.exe
4700	powershell.exe
2368	powershell.exe
5064	powershell.exe
4504	powershell.exe
3816	powershell.exe
3428	powershell.exe
2904	powershell.exe
884	powershell.exe
3748	powershell.exe
2776	RuntimeBroker.exe
1580	RuntimeBroker.exe
1292	RuntimeBroker.exe
2988	RuntimeBroker.exe
1788	RuntimeBroker.exe
1496	RuntimeBroker.exe
2564	RuntimeBroker.exe
2232	RuntimeBroker.exe
220	RuntimeBroker.exe
1940	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	DllCommonsvc.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	2776	RuntimeBroker.exe
Token: SeDebugPrivilege	1580	RuntimeBroker.exe
Token: SeDebugPrivilege	1292	RuntimeBroker.exe
Token: SeDebugPrivilege	2988	RuntimeBroker.exe
Token: SeDebugPrivilege	1788	RuntimeBroker.exe
Token: SeDebugPrivilege	1496	RuntimeBroker.exe
Token: SeDebugPrivilege	2564	RuntimeBroker.exe
Token: SeDebugPrivilege	2232	RuntimeBroker.exe
Token: SeDebugPrivilege	220	RuntimeBroker.exe
Token: SeDebugPrivilege	1940	RuntimeBroker.exe
Token: SeDebugPrivilege	4776	RuntimeBroker.exe
Token: SeDebugPrivilege	428	RuntimeBroker.exe
Token: SeDebugPrivilege	2004	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3568	3456	JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe	83
PID 3456 wrote to memory of 3568	3456	JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe	83
PID 3456 wrote to memory of 3568	3456	JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe	83
PID 3568 wrote to memory of 4984	3568	WScript.exe	84
PID 3568 wrote to memory of 4984	3568	WScript.exe	84
PID 3568 wrote to memory of 4984	3568	WScript.exe	84
PID 4984 wrote to memory of 436	4984	cmd.exe	86
PID 4984 wrote to memory of 436	4984	cmd.exe	86
PID 436 wrote to memory of 3748	436	DllCommonsvc.exe	131
PID 436 wrote to memory of 3748	436	DllCommonsvc.exe	131
PID 436 wrote to memory of 3816	436	DllCommonsvc.exe	132
PID 436 wrote to memory of 3816	436	DllCommonsvc.exe	132
PID 436 wrote to memory of 2904	436	DllCommonsvc.exe	133
PID 436 wrote to memory of 2904	436	DllCommonsvc.exe	133
PID 436 wrote to memory of 2964	436	DllCommonsvc.exe	134
PID 436 wrote to memory of 2964	436	DllCommonsvc.exe	134
PID 436 wrote to memory of 1276	436	DllCommonsvc.exe	135
PID 436 wrote to memory of 1276	436	DllCommonsvc.exe	135
PID 436 wrote to memory of 884	436	DllCommonsvc.exe	136
PID 436 wrote to memory of 884	436	DllCommonsvc.exe	136
PID 436 wrote to memory of 2684	436	DllCommonsvc.exe	137
PID 436 wrote to memory of 2684	436	DllCommonsvc.exe	137
PID 436 wrote to memory of 2368	436	DllCommonsvc.exe	138
PID 436 wrote to memory of 2368	436	DllCommonsvc.exe	138
PID 436 wrote to memory of 4504	436	DllCommonsvc.exe	139
PID 436 wrote to memory of 4504	436	DllCommonsvc.exe	139
PID 436 wrote to memory of 5064	436	DllCommonsvc.exe	140
PID 436 wrote to memory of 5064	436	DllCommonsvc.exe	140
PID 436 wrote to memory of 4568	436	DllCommonsvc.exe	141
PID 436 wrote to memory of 4568	436	DllCommonsvc.exe	141
PID 436 wrote to memory of 3428	436	DllCommonsvc.exe	142
PID 436 wrote to memory of 3428	436	DllCommonsvc.exe	142
PID 436 wrote to memory of 3312	436	DllCommonsvc.exe	143
PID 436 wrote to memory of 3312	436	DllCommonsvc.exe	143
PID 436 wrote to memory of 4700	436	DllCommonsvc.exe	144
PID 436 wrote to memory of 4700	436	DllCommonsvc.exe	144
PID 436 wrote to memory of 980	436	DllCommonsvc.exe	145
PID 436 wrote to memory of 980	436	DllCommonsvc.exe	145
PID 436 wrote to memory of 1184	436	DllCommonsvc.exe	161
PID 436 wrote to memory of 1184	436	DllCommonsvc.exe	161
PID 1184 wrote to memory of 3696	1184	cmd.exe	163
PID 1184 wrote to memory of 3696	1184	cmd.exe	163
PID 1184 wrote to memory of 2776	1184	cmd.exe	165
PID 1184 wrote to memory of 2776	1184	cmd.exe	165
PID 2776 wrote to memory of 2020	2776	RuntimeBroker.exe	169
PID 2776 wrote to memory of 2020	2776	RuntimeBroker.exe	169
PID 2020 wrote to memory of 2664	2020	cmd.exe	171
PID 2020 wrote to memory of 2664	2020	cmd.exe	171
PID 2020 wrote to memory of 1580	2020	cmd.exe	177
PID 2020 wrote to memory of 1580	2020	cmd.exe	177
PID 1580 wrote to memory of 2208	1580	RuntimeBroker.exe	183
PID 1580 wrote to memory of 2208	1580	RuntimeBroker.exe	183
PID 2208 wrote to memory of 3180	2208	cmd.exe	185
PID 2208 wrote to memory of 3180	2208	cmd.exe	185
PID 2208 wrote to memory of 1292	2208	cmd.exe	189
PID 2208 wrote to memory of 1292	2208	cmd.exe	189
PID 1292 wrote to memory of 456	1292	RuntimeBroker.exe	192
PID 1292 wrote to memory of 456	1292	RuntimeBroker.exe	192
PID 456 wrote to memory of 3060	456	cmd.exe	194
PID 456 wrote to memory of 3060	456	cmd.exe	194
PID 456 wrote to memory of 2988	456	cmd.exe	196
PID 456 wrote to memory of 2988	456	cmd.exe	196
PID 2988 wrote to memory of 532	2988	RuntimeBroker.exe	198
PID 2988 wrote to memory of 532	2988	RuntimeBroker.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\fr-FR\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ywVuUyywYK.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3696
      - C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2664
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I4yJNRBzAA.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3180
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3060
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
        13⤵
        
        PID:532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2956
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat"
        15⤵
        
        PID:2436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3976
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat"
        17⤵
        
        PID:944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3800
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
        19⤵
        
        PID:4724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1204
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat"
        21⤵
        
        PID:4180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:376
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dk6czFnjgV.bat"
        23⤵
        
        PID:3936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:876
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
        25⤵
        
        PID:2128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2324
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
        27⤵
        
        PID:1056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:5064
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat"
        29⤵
        
        PID:1848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3608
        
        C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N7XO3McAFn.bat"
        31⤵
        
        PID:3060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Media\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Application Data\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Application Data\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1Gu59oh2IN.bat

Filesize
226B

MD5
5f1cba35f2d6fc77250edb600dc2b1ea

SHA1
d41b49b1ea7385b630e5bd926c16c13d05b25fd0

SHA256
ea827ea812f30a6fd64bce48ae0a09308cfce6dabf9d4e993966be22960cfe3a

SHA512
02aa9352960e10ce42509c90ded102a4d1e4cf6817ccece27e80f820c7cc26b93218b9eaf01ff907dc4ec8e4c0219698bfec63b98f825446fab9ddf8d7ed0b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat

Filesize
226B

MD5
419c4b12485ba632374275df40ee6012

SHA1
796f2c2c29b62e38dee4fac68c315b0df8a5d7c4

SHA256
2f1d5a995bc9067e0651ab08a61351782ba570c88a5b6f1b4651171fd0fc2d3b

SHA512
153508509a2b8cc3860a8cdd46b5895604651e8855dddbf594e559c25318511b20ee9b711159fb6988421836f9488dfc0dd65314e2a36378250c5f7285e158cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat

Filesize
226B

MD5
3311c337abe6595ce236c1c0388f792d

SHA1
a2f4692c4fbf50ead0c555e6fd1fdb610cea1df2

SHA256
61d89863baee43f3effe925ba55cd8313e893234862a8194872565f0955e8ca4

SHA512
cb75e302c94f6e158b4e58a1f2111dc77eef3513c0db81d40df11538fc10815c66e94ee0c73acdfa791bfc25a3bd9da17069c98192ce7330532e17dfbdef3076

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat

Filesize
226B

MD5
5083f1d2888596e06fed378308f0004c

SHA1
cf440ab7d7fd5d73fb409fe64062e12c609af044

SHA256
23a05921496705109dac53334faf439a59defb9d47b55dc47bfb56cf33ae1a01

SHA512
6a9bf4f223bbe218a0c9b64412b58ad71bacfb2364d3783d79043c2ff072f64d20a3c357562061652261fd34d62f4d5f7e51be6eb2bdecbc8d5782da8cfc868d

Download Submit
C:\Users\Admin\AppData\Local\Temp\I4yJNRBzAA.bat

Filesize
226B

MD5
f47118bf19c822a824a20e0d223096fa

SHA1
0bc0c8c91a8997a4f232a3ea5fb96e3675f8c47f

SHA256
0ed959ea787b642e4a3fa096f19b2fce1d38f4f51f80e181b90fdb7cd1410809

SHA512
9869b3daa2719c7f5f4074caf08ac23b0af2975be87e1b9b2428876d4e5801496b728cb40326095843090ea6a0409654d3d91c6a8e9af3a9213d54793b4374d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\N7XO3McAFn.bat

Filesize
226B

MD5
c1962b3b7b9baafde8a0cc61da388c87

SHA1
9ad6fde6b42a0c23a22248f82c2433d13b043168

SHA256
9e733a65c482bbaa17659bd8c4a3a9181a708c5a8b3f3cb9eb21a94dc304a33c

SHA512
bd40794ff1eac27116cb1077a26ab40f1540f3dd3af87a1a5653ebc6cbd08c9d9b6e80e447d5000c18f46fb27fc885cc3073437c6fa69db52ba6d26862da636d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat

Filesize
226B

MD5
bf91bdaea65bd9ffced79550358434e0

SHA1
e034d7723e1fd7a73a621a9876eda33e489507b5

SHA256
db560f76e54180548614667454eeb1d8551439ce57c00732ad76f469d5d96e88

SHA512
2d2187ccbbd5427ba7a865e91f99f6de907282a484c673720061599da164b8f4f5455e72b96948c045d4a8f1b508ec2b5f67fe8aeb3d4ab8dd327eebe4d497d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat

Filesize
226B

MD5
497e3e60766f6e668048344712fddd93

SHA1
83415820f7fc1ffa87f923d5addb7f5705702f91

SHA256
b8c91f591f2e6dc12142643ad41cbda7d180f5a1ff26bfa47090d0d471349e8f

SHA512
12e5f67e882e635a043fbde37401584831d136d6aec99fddfba5c777ae68610ab5db79df32c0055b63821bcb4ed732818732e0410b851ad266b88dd05643497f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pgihaz3a.0wg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dk6czFnjgV.bat

Filesize
226B

MD5
2de646d4183d50ad82f18a342d982552

SHA1
222fb9e214dc59889cd7374be47e280a5f460e77

SHA256
0bc6163b3bdb0dbd97f2a4e88b055f428d1da448c537e2b1bb09c30e42e6140f

SHA512
f952fb2d1b6bc6c1cdcfe82ce852c3b79b2b4661b15f9559ec3f85a6e2160f4b4f06f9f1f55aeca023768a6eadba360e5d0a79b431f98debc79e53e3aca9a250

Download Submit
C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat

Filesize
226B

MD5
fc0300fc12b4f29f2a80f7c6303127c9

SHA1
30c8a11fabac139920e42938483d73b14d388bfa

SHA256
b731ac7bfa5c8fb404993e3e2a1d1b59af541f53a036984fabb5c379e72e904c

SHA512
9c99c3123358c306108a5a1c8d7e1410aef90e5d985dd9e4fac2d7e70b774de62f142146840824bafbf72e82b8792235ceb58eef5678fad833796217220017ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat

Filesize
226B

MD5
74f3c2ed6918722777b1a40e8a235cd0

SHA1
bbfb76a2ca0feb4e90622772e8a1f8772e220af2

SHA256
c6f484af981b1164b460b3f3a5582fbca7be536c662f789103e811391e51219e

SHA512
1648296431804cfeb65cd092aaf49126a6ebfdab6ea6b27f9a41aee2794f579f4abb788289c268f6239b161bdd610427e40e739b0a6217b0e0ee14b1c41482c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ywVuUyywYK.bat

Filesize
226B

MD5
eeba3a8a2b1cc70295a59f86baae5df0

SHA1
66b62e93e86cb2dbd1019bb179826f92c5f1d01e

SHA256
25d96a4e57f0a7c6a90d650d399f6d9529e4c6d067bd5e4c77439dfbf453dac3

SHA512
b6ed874ed1e64b1e9fd4d6f1392ceaa82a0b89b337dca450ed2db5a7593fec1cd0bd450305dd47534c5412ebca14628b2e7fb5a43677b412c99709498558cbe8

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/428-297-0x000000001B7F0000-0x000000001B802000-memory.dmp

Filesize
72KB

Download
memory/436-14-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/436-15-0x00000000026E0000-0x00000000026EC000-memory.dmp

Filesize
48KB

Download
memory/436-17-0x00000000026F0000-0x00000000026FC000-memory.dmp

Filesize
48KB

Download
memory/436-16-0x00000000026D0000-0x00000000026DC000-memory.dmp

Filesize
48KB

Download
memory/436-13-0x00000000004A0000-0x00000000005B0000-memory.dmp

Filesize
1.1MB

Download
memory/436-12-0x00007FFEC8B93000-0x00007FFEC8B95000-memory.dmp

Filesize
8KB

Download
memory/1292-240-0x000000001CA00000-0x000000001CB02000-memory.dmp

Filesize
1.0MB

Download
memory/1496-262-0x000000001D900000-0x000000001DA02000-memory.dmp

Filesize
1.0MB

Download
memory/1496-257-0x000000001BDF0000-0x000000001BE02000-memory.dmp

Filesize
72KB

Download
memory/1788-254-0x000000001CA00000-0x000000001CB02000-memory.dmp

Filesize
1.0MB

Download
memory/2232-272-0x000000001AFF0000-0x000000001B002000-memory.dmp

Filesize
72KB

Download
memory/2564-269-0x000000001CF00000-0x000000001D002000-memory.dmp

Filesize
1.0MB

Download
memory/2684-60-0x000001BF1BC90000-0x000001BF1BCB2000-memory.dmp

Filesize
136KB

Download
memory/2988-247-0x000000001D300000-0x000000001D402000-memory.dmp

Filesize
1.0MB

Download