dcrat | f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
Size

1.3MB
MD5

fd9aa1eb485121846732067f4cdd0bc5
SHA1

a7a4ed018767a96f084fd838311a5d47d45927ee
SHA256

f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce
SHA512

48a82c9c7333e305634db26afc5d45127d60e1ba1f8945d3ded614bd947b3ccaabcfec60c57537fd0dfbbd3002eb00fe31f51a7ac3030ea35001cb52b66eeef4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	3060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3060	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023ca7-10.dat	dcrat
behavioral2/memory/4680-13-0x0000000000780000-0x0000000000890000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3160	powershell.exe
3976	powershell.exe
4664	powershell.exe
2328	powershell.exe
4636	powershell.exe
3820	powershell.exe
3268	powershell.exe
1164	powershell.exe
2924	powershell.exe
2448	powershell.exe
3228	powershell.exe
1716	powershell.exe
4816	powershell.exe

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 17 IoCs

pid	Process
4680	DllCommonsvc.exe
868	dwm.exe
4540	dwm.exe
1212	dwm.exe
4664	dwm.exe
1964	dwm.exe
2168	dwm.exe
3172	dwm.exe
4696	dwm.exe
3484	dwm.exe
4188	dwm.exe
3224	dwm.exe
1680	dwm.exe
1180	dwm.exe
1952	dwm.exe
3616	dwm.exe
1524	dwm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
39	raw.githubusercontent.com
47	raw.githubusercontent.com
55	raw.githubusercontent.com
17	raw.githubusercontent.com
52	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
38	raw.githubusercontent.com
41	raw.githubusercontent.com
40	raw.githubusercontent.com
57	raw.githubusercontent.com
16	raw.githubusercontent.com
24	raw.githubusercontent.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\defaults\pref\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\27d1bcfc3c54e0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1760	schtasks.exe
228	schtasks.exe
4768	schtasks.exe
4148	schtasks.exe
2304	schtasks.exe
4608	schtasks.exe
2580	schtasks.exe
4356	schtasks.exe
3188	schtasks.exe
1460	schtasks.exe
3704	schtasks.exe
1112	schtasks.exe
1044	schtasks.exe
2428	schtasks.exe
4648	schtasks.exe
1492	schtasks.exe
3744	schtasks.exe
4532	schtasks.exe
4812	schtasks.exe
5108	schtasks.exe
3172	schtasks.exe
2420	schtasks.exe
1500	schtasks.exe
2764	schtasks.exe
5040	schtasks.exe
1964	schtasks.exe
1904	schtasks.exe
4920	schtasks.exe
4048	schtasks.exe
2404	schtasks.exe
1516	schtasks.exe
2348	schtasks.exe
4188	schtasks.exe
4576	schtasks.exe
940	schtasks.exe
4540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
4680	DllCommonsvc.exe
3160	powershell.exe
3160	powershell.exe
3976	powershell.exe
3976	powershell.exe
4636	powershell.exe
4636	powershell.exe
3228	powershell.exe
3228	powershell.exe
2924	powershell.exe
2924	powershell.exe
1716	powershell.exe
1716	powershell.exe
3820	powershell.exe
3820	powershell.exe
2448	powershell.exe
2448	powershell.exe
4816	powershell.exe
4816	powershell.exe
1164	powershell.exe
1164	powershell.exe
3268	powershell.exe
3268	powershell.exe
2328	powershell.exe
2328	powershell.exe
4664	powershell.exe
4664	powershell.exe
3268	powershell.exe
868	dwm.exe
868	dwm.exe
2328	powershell.exe
2924	powershell.exe
4636	powershell.exe
3976	powershell.exe
3160	powershell.exe
2448	powershell.exe
3228	powershell.exe
1164	powershell.exe
4816	powershell.exe
1716	powershell.exe
3820	powershell.exe
4664	powershell.exe
4540	dwm.exe
1212	dwm.exe
4664	dwm.exe
1964	dwm.exe
2168	dwm.exe
3172	dwm.exe
4696	dwm.exe
3484	dwm.exe
4188	dwm.exe
3224	dwm.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	DllCommonsvc.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	868	dwm.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	4540	dwm.exe
Token: SeDebugPrivilege	1212	dwm.exe
Token: SeDebugPrivilege	4664	dwm.exe
Token: SeDebugPrivilege	1964	dwm.exe
Token: SeDebugPrivilege	2168	dwm.exe
Token: SeDebugPrivilege	3172	dwm.exe
Token: SeDebugPrivilege	4696	dwm.exe
Token: SeDebugPrivilege	3484	dwm.exe
Token: SeDebugPrivilege	4188	dwm.exe
Token: SeDebugPrivilege	3224	dwm.exe
Token: SeDebugPrivilege	1680	dwm.exe
Token: SeDebugPrivilege	1180	dwm.exe
Token: SeDebugPrivilege	1952	dwm.exe
Token: SeDebugPrivilege	3616	dwm.exe
Token: SeDebugPrivilege	1524	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 60	4852	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	83
PID 4852 wrote to memory of 60	4852	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	83
PID 4852 wrote to memory of 60	4852	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	83
PID 60 wrote to memory of 1020	60	WScript.exe	85
PID 60 wrote to memory of 1020	60	WScript.exe	85
PID 60 wrote to memory of 1020	60	WScript.exe	85
PID 1020 wrote to memory of 4680	1020	cmd.exe	87
PID 1020 wrote to memory of 4680	1020	cmd.exe	87
PID 4680 wrote to memory of 4664	4680	DllCommonsvc.exe	126
PID 4680 wrote to memory of 4664	4680	DllCommonsvc.exe	126
PID 4680 wrote to memory of 3160	4680	DllCommonsvc.exe	127
PID 4680 wrote to memory of 3160	4680	DllCommonsvc.exe	127
PID 4680 wrote to memory of 2924	4680	DllCommonsvc.exe	128
PID 4680 wrote to memory of 2924	4680	DllCommonsvc.exe	128
PID 4680 wrote to memory of 3976	4680	DllCommonsvc.exe	129
PID 4680 wrote to memory of 3976	4680	DllCommonsvc.exe	129
PID 4680 wrote to memory of 1164	4680	DllCommonsvc.exe	130
PID 4680 wrote to memory of 1164	4680	DllCommonsvc.exe	130
PID 4680 wrote to memory of 2448	4680	DllCommonsvc.exe	132
PID 4680 wrote to memory of 2448	4680	DllCommonsvc.exe	132
PID 4680 wrote to memory of 2328	4680	DllCommonsvc.exe	133
PID 4680 wrote to memory of 2328	4680	DllCommonsvc.exe	133
PID 4680 wrote to memory of 3228	4680	DllCommonsvc.exe	134
PID 4680 wrote to memory of 3228	4680	DllCommonsvc.exe	134
PID 4680 wrote to memory of 4636	4680	DllCommonsvc.exe	135
PID 4680 wrote to memory of 4636	4680	DllCommonsvc.exe	135
PID 4680 wrote to memory of 1716	4680	DllCommonsvc.exe	136
PID 4680 wrote to memory of 1716	4680	DllCommonsvc.exe	136
PID 4680 wrote to memory of 3820	4680	DllCommonsvc.exe	137
PID 4680 wrote to memory of 3820	4680	DllCommonsvc.exe	137
PID 4680 wrote to memory of 3268	4680	DllCommonsvc.exe	138
PID 4680 wrote to memory of 3268	4680	DllCommonsvc.exe	138
PID 4680 wrote to memory of 4816	4680	DllCommonsvc.exe	139
PID 4680 wrote to memory of 4816	4680	DllCommonsvc.exe	139
PID 4680 wrote to memory of 868	4680	DllCommonsvc.exe	151
PID 4680 wrote to memory of 868	4680	DllCommonsvc.exe	151
PID 868 wrote to memory of 4088	868	dwm.exe	154
PID 868 wrote to memory of 4088	868	dwm.exe	154
PID 4088 wrote to memory of 3188	4088	cmd.exe	156
PID 4088 wrote to memory of 3188	4088	cmd.exe	156
PID 4088 wrote to memory of 4540	4088	cmd.exe	165
PID 4088 wrote to memory of 4540	4088	cmd.exe	165
PID 4540 wrote to memory of 2404	4540	dwm.exe	171
PID 4540 wrote to memory of 2404	4540	dwm.exe	171
PID 2404 wrote to memory of 3740	2404	cmd.exe	173
PID 2404 wrote to memory of 3740	2404	cmd.exe	173
PID 2404 wrote to memory of 1212	2404	cmd.exe	178
PID 2404 wrote to memory of 1212	2404	cmd.exe	178
PID 1212 wrote to memory of 1328	1212	dwm.exe	180
PID 1212 wrote to memory of 1328	1212	dwm.exe	180
PID 1328 wrote to memory of 940	1328	cmd.exe	182
PID 1328 wrote to memory of 940	1328	cmd.exe	182
PID 1328 wrote to memory of 4664	1328	cmd.exe	184
PID 1328 wrote to memory of 4664	1328	cmd.exe	184
PID 4664 wrote to memory of 2344	4664	dwm.exe	186
PID 4664 wrote to memory of 2344	4664	dwm.exe	186
PID 2344 wrote to memory of 1188	2344	cmd.exe	188
PID 2344 wrote to memory of 1188	2344	cmd.exe	188
PID 2344 wrote to memory of 1964	2344	cmd.exe	190
PID 2344 wrote to memory of 1964	2344	cmd.exe	190
PID 1964 wrote to memory of 2192	1964	dwm.exe	192
PID 1964 wrote to memory of 2192	1964	dwm.exe	192
PID 2192 wrote to memory of 2704	2192	cmd.exe	194
PID 2192 wrote to memory of 2704	2192	cmd.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\uk-UA\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:868
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZDYK5nApHO.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3188
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3740
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i32OxRBhll.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:940
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IVqzzTSBcr.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1188
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2704
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat"
        16⤵
        
        PID:3540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4888
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"
        18⤵
        
        PID:4828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1636
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat"
        20⤵
        
        PID:1556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1224
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat"
        22⤵
        
        PID:4136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1476
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat"
        24⤵
        
        PID:868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2380
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IVqzzTSBcr.bat"
        26⤵
        
        PID:4448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1460
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat"
        28⤵
        
        PID:4540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:3916
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"
        30⤵
        
        PID:32
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:4696
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat"
        32⤵
        
        PID:1164
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:4664
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat"
        34⤵
        
        PID:2736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        35⤵
        
        PID:3816
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lAZRwHYzWc.bat"
        36⤵
        
        PID:2016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        37⤵
        
        PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\providercommon\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat

Filesize
223B

MD5
f007945b5e2da43892351e20b8736fcd

SHA1
a2a057e95117489c214f8dc7727b68c76e2dfa6c

SHA256
cd282ba1dd3b71223cd6c1b2667e0ca04a7f7c0ecf38089c4c47e3f5eb3f6e5a

SHA512
45e59a25ab9f4e003ca817f5fecb0903fc9626b1f2d643060d255b41f0bb15c6ebbcf821bbe4fabbb92c9410a57ceef3fe34ca34e5cdf97371ae5f9a3ef22894

Download Submit
C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat

Filesize
223B

MD5
b6de9104f4e400db561ae85b92522ee4

SHA1
c38117f93530b7265f68f60ab4b01fa41675446e

SHA256
f0bcbc44fd8ce5a4fd70a8e6c3a35ab26294a8a71e30bc6bc7b751c044df1071

SHA512
20155c4257346ceee54963cfea7ea56638c9265d794bda1426220edc7f7f39629a2d8482d478ffd6fd343fe6df388ae968d898e3135936b96c11de7700aa46cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat

Filesize
223B

MD5
718491db25aed55f5c6f58f64cbc3733

SHA1
5e5615dd618f21be1690ffcf72c5c6edd503f2c1

SHA256
c42ec236dba7d8f258b54f18818f3c11c8e43e5b3af56cdb5d5c1e1e748a7521

SHA512
f79c7c31d205727a7d94bbfce689d08c141539f7b4d486693c0f2c8c05d1fd3ecafdee31ff93960000af13838f8d5ab527d524c7678675469bcfb83ed5b83a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IVqzzTSBcr.bat

Filesize
223B

MD5
daf930c67f5137c8ce2b833190cf2149

SHA1
5b3100ccf399d1cd27fefaca59d3347a73a08656

SHA256
c344d169724dbe96595f53f08d0dec643c91c09fa179ff84da68d5f153953dbf

SHA512
a1e2e1efeeb95055effeaebc237a77300fcdc46826f937948fc550289b73c369ccd9bc62c403b9c25b387d035006b5698b6123ca1eb49040fffba89b3217821f

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat

Filesize
223B

MD5
322a749289c084bca83e1a65a93cca13

SHA1
477f151e44ebb389461ef292ee3f32533f00d22c

SHA256
1146a077081b31f51045bae02632fdfbceb25454b56fd98c12e30fb684e65ba9

SHA512
4fb2501d7a90a80982c6485c8ee9f79e47f782e7e1d91ab52bcedd5b601322f6b889078fde67120543be906b169fbf459852dbc45856951b2a28f5404fc31b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat

Filesize
223B

MD5
1ac5362c199a1c9c9608a00e325d49ca

SHA1
53768e697a1f41cd7d4218aa0f8394d882b02ac1

SHA256
f31b675ab4ee28e88a2899c2f9c3d607347a7b0ce78cfcee3ef096e10f28d854

SHA512
a1819ecf217821942180b406c7c862471122cb2c3ef11155eb79fd517de6bf2c17149eefaea6d0b764ebf2234fd54d3b70b02d70595d4011d40831a710d853f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat

Filesize
223B

MD5
fcc6f740f769e2f06f0d0357f3b8da7f

SHA1
fca871a610dbebd5982f173cc327f8c0f425c6ae

SHA256
575e08b1c8a2b058daedc5f9af9fc4c077f930da49788a505f9ca91971da0521

SHA512
9ab5ddb18710ce6b66b739a587190284a69d4d025ec60b35412dec0377ee424d6cc3960cda5bb96cc7fe3fb436b1a71aa610daa1749b2ad17b5c56c00f829690

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZDYK5nApHO.bat

Filesize
223B

MD5
1ffc7b147df4b55d796bc2cafeb6b3ba

SHA1
fe37480184306bc5cfa5395f1ad4db9ce8dc3a87

SHA256
091c8926f4f6f7c98938dd0887d94b8885d38835f82fefa269bb7b565bc309d2

SHA512
1abe30738d74a2faf968fafe77fa4a11eb8eedf58a3b4dd66fd390a63cc242a6f38f72f6462431b4ab76f547d13c9ef4af34e43e5a1332d1861e89e3e575fa59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iql5cwst.4qr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat

Filesize
223B

MD5
06d6b16e8977af6d092e6ed33a56b535

SHA1
43450df96e7276524953d862889b6f189f433c57

SHA256
813d6097aba463b0fbafd368db24a9c3e14a56b6aab505b1c47f328d215c2280

SHA512
c77deb17945256028313780b7489690e02ee5dd68810808e4690a244e093363e8692bd3c415d699d8b546081843f206026f749facfa2afd9b330fc440d7f4827

Download Submit
C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat

Filesize
223B

MD5
d4fd0e77ca3e9fbe6645ef090abce4e3

SHA1
6c1ca0ff503b430984103887c215782ecf591aae

SHA256
b7507489b4dfd9fca283d4a5dc11f7384900cf838fbbb90c330bf12f4856545b

SHA512
bf8e796b9ee85f36286111ef3da412a19ef39286cb183b26a1f1b9fe826ae00246a020fcef485e7d848588d48e64b618fe0ff85952969e44142789a63aae2bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\i32OxRBhll.bat

Filesize
223B

MD5
bbc162a74ccac7d6527fa1c0d9fd702b

SHA1
a49c2d44d32b9120dbff6a8cfcc297c34791cb19

SHA256
e8258d76e1f068b3e3396f95d7b43720ff3e14141db329a0527779fb93f27e9d

SHA512
c63d375847a7caa0b326c4f7189224060e13764ccacb55128e6b7398409d450900b39f8d43e6ed9fa1b67d388974b7c3d456f3476f45f4af0337c82e46706ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat

Filesize
223B

MD5
db4f79e4aae6b4610847615a5bdae484

SHA1
41f8dc86b0b24b08781c44c51612f2be901dcbe0

SHA256
3a35003db2695a12103df6ff4c876afca72c2b2e8696182ee6704b8196407eb2

SHA512
8c79009f34162b701e3d09a569ad4fd3effadf301a572df53c47081e4adccea33dfba1afb22474f5737b1c4e9ca68f53b99a1fa3d5ef095ab80c0339c80e69b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lAZRwHYzWc.bat

Filesize
223B

MD5
359941bbdd99102cddaec06e19894d0e

SHA1
0062ce77d29ccd2f352b7dbdd4e6c690cb6e490a

SHA256
8f2319c19d6013155de48372e5a42e62c00c42272cea428690f31e3112bcd6cd

SHA512
e3cdb4d3280eddebef623c2b69463643b93665f03a0bbdcd2058579195f06f1f78ad58f3c5df6d6307c8f750a0a2c3d16e068a2a5d3f98627a456ec8f4bb4706

Download Submit
C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat

Filesize
223B

MD5
65f806e3d242a1bdf0b3dda8acb32f77

SHA1
4a0d4702a99b405307248354ae7a3e923637128d

SHA256
19ed99e2641849a600ac3383f691faecf0084c74cf6fd2f17caefc152e8402d3

SHA512
95327c1dcdbe4e8aac4d0e2bbd53abf44f36e2615f1b72c89e759bade635525e0241dd201ccc20973631a7b9fcd6de823a994c88eafed363e346b0d8cc130bb0

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/868-203-0x000000001CA10000-0x000000001CB7A000-memory.dmp

Filesize
1.4MB

Download
memory/1680-272-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/2448-53-0x0000020773F10000-0x0000020773F32000-memory.dmp

Filesize
136KB

Download
memory/3172-238-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/3484-252-0x0000000002F00000-0x0000000002F12000-memory.dmp

Filesize
72KB

Download
memory/4188-259-0x00000000011C0000-0x00000000011D2000-memory.dmp

Filesize
72KB

Download
memory/4540-207-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/4680-13-0x0000000000780000-0x0000000000890000-memory.dmp

Filesize
1.1MB

Download
memory/4680-14-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/4680-12-0x00007FF8DEFC3000-0x00007FF8DEFC5000-memory.dmp

Filesize
8KB

Download
memory/4680-15-0x000000001B3A0000-0x000000001B3AC000-memory.dmp

Filesize
48KB

Download
memory/4680-16-0x0000000002AB0000-0x0000000002ABC000-memory.dmp

Filesize
48KB

Download
memory/4680-17-0x000000001B3B0000-0x000000001B3BC000-memory.dmp

Filesize
48KB

Download
memory/4696-245-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download