dcrat | ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe
Size

1.3MB
MD5

22820d31527ca42dd7442c8c5bb7d86d
SHA1

a1ff80482a6f29d43771efc245ea4c42e779c503
SHA256

ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a
SHA512

8dfe20595cdd0c73bbaf6678a23679aaab2f1d3e5a63da20d60e09d45752055963002c40bd8fc3e1c8f978604edf18d55389f4042a2f15f28d354799880e794c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2672	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	2672	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b8e-9.dat	dcrat
behavioral2/memory/5064-13-0x00000000003E0000-0x00000000004F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe
3168	powershell.exe
3816	powershell.exe
3600	powershell.exe
2112	powershell.exe
1840	powershell.exe
2324	powershell.exe
1640	powershell.exe
1820	powershell.exe
908	powershell.exe
4828	powershell.exe
212	powershell.exe
1076	powershell.exe
3620	powershell.exe
3284	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	unsecapp.exe

Executes dropped EXE 15 IoCs

pid	Process
5064	DllCommonsvc.exe
3388	unsecapp.exe
2248	unsecapp.exe
2712	unsecapp.exe
2592	unsecapp.exe
1584	unsecapp.exe
4828	unsecapp.exe
2824	unsecapp.exe
2508	unsecapp.exe
404	unsecapp.exe
3284	unsecapp.exe
4052	unsecapp.exe
2372	unsecapp.exe
3340	unsecapp.exe
2016	unsecapp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
44	raw.githubusercontent.com
52	raw.githubusercontent.com
17	raw.githubusercontent.com
42	raw.githubusercontent.com
53	raw.githubusercontent.com
36	raw.githubusercontent.com
39	raw.githubusercontent.com
38	raw.githubusercontent.com
48	raw.githubusercontent.com
50	raw.githubusercontent.com
18	raw.githubusercontent.com
24	raw.githubusercontent.com
51	raw.githubusercontent.com
43	raw.githubusercontent.com
49	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe	DllCommonsvc.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemResources\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\Branding\shellbrd\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\Help\Help\unsecapp.exe	DllCommonsvc.exe
File created	C:\Windows\Panther\actionqueue\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\6ccacd8608530f	DllCommonsvc.exe
File opened for modification	C:\Windows\PolicyDefinitions\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\Branding\shellbrd\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\Help\Help\29c1c3cc0f7685	DllCommonsvc.exe
File created	C:\Windows\Panther\actionqueue\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\System\Speech\upfc.exe	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\Idle.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	unsecapp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3508	schtasks.exe
1860	schtasks.exe
3588	schtasks.exe
1060	schtasks.exe
5116	schtasks.exe
2740	schtasks.exe
2468	schtasks.exe
5060	schtasks.exe
2084	schtasks.exe
2100	schtasks.exe
3256	schtasks.exe
1628	schtasks.exe
1604	schtasks.exe
4904	schtasks.exe
4712	schtasks.exe
2072	schtasks.exe
2904	schtasks.exe
3908	schtasks.exe
1452	schtasks.exe
912	schtasks.exe
4640	schtasks.exe
3016	schtasks.exe
3836	schtasks.exe
2796	schtasks.exe
4536	schtasks.exe
1116	schtasks.exe
5000	schtasks.exe
3956	schtasks.exe
3532	schtasks.exe
3700	schtasks.exe
2248	schtasks.exe
4760	schtasks.exe
576	schtasks.exe
1948	schtasks.exe
3852	schtasks.exe
1900	schtasks.exe
3900	schtasks.exe
3064	schtasks.exe
4884	schtasks.exe
4704	schtasks.exe
5056	schtasks.exe
3128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
5064	DllCommonsvc.exe
3620	powershell.exe
3620	powershell.exe
212	powershell.exe
212	powershell.exe
908	powershell.exe
908	powershell.exe
3600	powershell.exe
3600	powershell.exe
1820	powershell.exe
1820	powershell.exe
3168	powershell.exe
3168	powershell.exe
2952	powershell.exe
2952	powershell.exe
1840	powershell.exe
1840	powershell.exe
1640	powershell.exe
1640	powershell.exe
3284	powershell.exe
3284	powershell.exe
4828	powershell.exe
4828	powershell.exe
2112	powershell.exe
2112	powershell.exe
1076	powershell.exe
1076	powershell.exe
2324	powershell.exe
2324	powershell.exe
3816	powershell.exe
3816	powershell.exe
3600	powershell.exe
3620	powershell.exe
3816	powershell.exe
212	powershell.exe
2952	powershell.exe
1640	powershell.exe
1820	powershell.exe
3284	powershell.exe
2324	powershell.exe
2112	powershell.exe
908	powershell.exe
1076	powershell.exe
1840	powershell.exe
3168	powershell.exe
4828	powershell.exe
3388	unsecapp.exe
2248	unsecapp.exe
2712	unsecapp.exe
2592	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	DllCommonsvc.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	3388	unsecapp.exe
Token: SeDebugPrivilege	2248	unsecapp.exe
Token: SeDebugPrivilege	2712	unsecapp.exe
Token: SeDebugPrivilege	2592	unsecapp.exe
Token: SeDebugPrivilege	1584	unsecapp.exe
Token: SeDebugPrivilege	4828	unsecapp.exe
Token: SeDebugPrivilege	2824	unsecapp.exe
Token: SeDebugPrivilege	2508	unsecapp.exe
Token: SeDebugPrivilege	404	unsecapp.exe
Token: SeDebugPrivilege	3284	unsecapp.exe
Token: SeDebugPrivilege	4052	unsecapp.exe
Token: SeDebugPrivilege	2372	unsecapp.exe
Token: SeDebugPrivilege	3340	unsecapp.exe
Token: SeDebugPrivilege	2016	unsecapp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4164	940	JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe	82
PID 940 wrote to memory of 4164	940	JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe	82
PID 940 wrote to memory of 4164	940	JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe	82
PID 4164 wrote to memory of 3396	4164	WScript.exe	83
PID 4164 wrote to memory of 3396	4164	WScript.exe	83
PID 4164 wrote to memory of 3396	4164	WScript.exe	83
PID 3396 wrote to memory of 5064	3396	cmd.exe	85
PID 3396 wrote to memory of 5064	3396	cmd.exe	85
PID 5064 wrote to memory of 1640	5064	DllCommonsvc.exe	129
PID 5064 wrote to memory of 1640	5064	DllCommonsvc.exe	129
PID 5064 wrote to memory of 3600	5064	DllCommonsvc.exe	130
PID 5064 wrote to memory of 3600	5064	DllCommonsvc.exe	130
PID 5064 wrote to memory of 3816	5064	DllCommonsvc.exe	131
PID 5064 wrote to memory of 3816	5064	DllCommonsvc.exe	131
PID 5064 wrote to memory of 2112	5064	DllCommonsvc.exe	132
PID 5064 wrote to memory of 2112	5064	DllCommonsvc.exe	132
PID 5064 wrote to memory of 4828	5064	DllCommonsvc.exe	133
PID 5064 wrote to memory of 4828	5064	DllCommonsvc.exe	133
PID 5064 wrote to memory of 3284	5064	DllCommonsvc.exe	134
PID 5064 wrote to memory of 3284	5064	DllCommonsvc.exe	134
PID 5064 wrote to memory of 1840	5064	DllCommonsvc.exe	135
PID 5064 wrote to memory of 1840	5064	DllCommonsvc.exe	135
PID 5064 wrote to memory of 212	5064	DllCommonsvc.exe	136
PID 5064 wrote to memory of 212	5064	DllCommonsvc.exe	136
PID 5064 wrote to memory of 2952	5064	DllCommonsvc.exe	137
PID 5064 wrote to memory of 2952	5064	DllCommonsvc.exe	137
PID 5064 wrote to memory of 1820	5064	DllCommonsvc.exe	138
PID 5064 wrote to memory of 1820	5064	DllCommonsvc.exe	138
PID 5064 wrote to memory of 908	5064	DllCommonsvc.exe	139
PID 5064 wrote to memory of 908	5064	DllCommonsvc.exe	139
PID 5064 wrote to memory of 1076	5064	DllCommonsvc.exe	140
PID 5064 wrote to memory of 1076	5064	DllCommonsvc.exe	140
PID 5064 wrote to memory of 3168	5064	DllCommonsvc.exe	141
PID 5064 wrote to memory of 3168	5064	DllCommonsvc.exe	141
PID 5064 wrote to memory of 3620	5064	DllCommonsvc.exe	142
PID 5064 wrote to memory of 3620	5064	DllCommonsvc.exe	142
PID 5064 wrote to memory of 2324	5064	DllCommonsvc.exe	143
PID 5064 wrote to memory of 2324	5064	DllCommonsvc.exe	143
PID 5064 wrote to memory of 4748	5064	DllCommonsvc.exe	159
PID 5064 wrote to memory of 4748	5064	DllCommonsvc.exe	159
PID 4748 wrote to memory of 2408	4748	cmd.exe	161
PID 4748 wrote to memory of 2408	4748	cmd.exe	161
PID 4748 wrote to memory of 3388	4748	cmd.exe	165
PID 4748 wrote to memory of 3388	4748	cmd.exe	165
PID 3388 wrote to memory of 2732	3388	unsecapp.exe	169
PID 3388 wrote to memory of 2732	3388	unsecapp.exe	169
PID 2732 wrote to memory of 2508	2732	cmd.exe	171
PID 2732 wrote to memory of 2508	2732	cmd.exe	171
PID 2732 wrote to memory of 2248	2732	cmd.exe	172
PID 2732 wrote to memory of 2248	2732	cmd.exe	172
PID 2248 wrote to memory of 1408	2248	unsecapp.exe	173
PID 2248 wrote to memory of 1408	2248	unsecapp.exe	173
PID 1408 wrote to memory of 3648	1408	cmd.exe	175
PID 1408 wrote to memory of 3648	1408	cmd.exe	175
PID 1408 wrote to memory of 2712	1408	cmd.exe	177
PID 1408 wrote to memory of 2712	1408	cmd.exe	177
PID 2712 wrote to memory of 1060	2712	unsecapp.exe	179
PID 2712 wrote to memory of 1060	2712	unsecapp.exe	179
PID 1060 wrote to memory of 3888	1060	cmd.exe	181
PID 1060 wrote to memory of 3888	1060	cmd.exe	181
PID 1060 wrote to memory of 2592	1060	cmd.exe	182
PID 1060 wrote to memory of 2592	1060	cmd.exe	182
PID 2592 wrote to memory of 4880	2592	unsecapp.exe	183
PID 2592 wrote to memory of 4880	2592	unsecapp.exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed2de70e556ff5f307ac2c7e2a5b354457bd3fa77c814bb7d422ad48e252201a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\shellbrd\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Help\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\actionqueue\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\it-IT\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cc8L5WWXRA.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4748
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2408
      - C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2508
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3648
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3888
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"
        13⤵
        
        PID:4880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:920
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKnLpNzAx9.bat"
        15⤵
        
        PID:2620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2148
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat"
        17⤵
        
        PID:4748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1996
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
        19⤵
        
        PID:3176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1752
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat"
        21⤵
        
        PID:1200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3104
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat"
        23⤵
        
        PID:2480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4136
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uq0hdwOOBc.bat"
        25⤵
        
        PID:4612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1612
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X5jGqiFaSS.bat"
        27⤵
        
        PID:1976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1208
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X5jGqiFaSS.bat"
        29⤵
        
        PID:4824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:2340
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat"
        31⤵
        
        PID:4820
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:4544
        
        C:\Windows\Help\Help\unsecapp.exe
        
        "C:\Windows\Help\Help\unsecapp.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat"
        33⤵
        
        PID:3396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\PolicyDefinitions\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Branding\shellbrd\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Branding\shellbrd\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\shellbrd\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Help\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Help\Help\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\Help\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\providercommon\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\actionqueue\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Panther\actionqueue\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\actionqueue\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\unsecapp.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat

Filesize
198B

MD5
f870db97b3c8a9567e067b39ed58cd16

SHA1
41640965fe52dccd12b807da19e9fe39db71b3ca

SHA256
6f6b72fe7905eea41e47c15fe3ee7fdbc8acc81a0d168a40a0c83e461edf0f3d

SHA512
bc9ae6171056d98b22367667cb5a3db735e437a044e27edddbbe0ba62d13db6b238c9b3362d6beec6dfed2429ba9f8242f597de40e418ca3c6b3dc3943659846

Download Submit
C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

Filesize
198B

MD5
5e083ba9dbd06c7a95fa93cab86bba70

SHA1
f936cd32d38c24cd67750c857ec28796c8056fb1

SHA256
0d80d904d59931eef79b43b2dc17b1dbc627ad02a1e7913616f7eb1eec3928a7

SHA512
eedb76e82ebdb7d5f3be4032358a5220b363f2088b619eb721561cb585d41b788b5f99b9505722081a26aa857d807d58d2409bb114f3d310b46de7d106c7f4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cc8L5WWXRA.bat

Filesize
198B

MD5
64d0bcf7bc30fdf614c795f695965197

SHA1
c1d9545873b5ecfebd6763661a7839778a490a7d

SHA256
0d474b1f9723cf30471f08ca94af9bf2d516278b58ee5ef9c9c37b4209c70888

SHA512
4a3a89eedb20f79b2f74343e781363eff3a9f37ba87473327525acfffb0dd27cf6d22b8edb51eb16a4bd1e8612f6e11f70492c9a7747e92684d19b010fd748fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat

Filesize
198B

MD5
30784c2ee9c768c71f2e07cd57f98f88

SHA1
f0cf4d6aa884de862a3b0353102519e363406165

SHA256
f86491ca8fd7f4d61b4c2e9f3d10b242a45036777b08f423a115139fd895c9b3

SHA512
45983854dbd7e9c05e12c3c96ada4ffde4e462a0995df709998c85fd5e90d2318865069ddcc8013713c24ecec68ee8e1dbeee60f322b6251043dc50d37a14d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat

Filesize
198B

MD5
8b563e65c734c589bd1c2b6356f44935

SHA1
b0739e8e1cd6f928000de62eb75a471b6c68bab9

SHA256
22bbd6b7a238deced69ca13025fd767e7d2501767284501b11b06194fc598738

SHA512
17b86bad3f838781a2ff12430c8ed39f1ef8cf99ccef014e8eb133d8e8160ceca7b206a8f089599e515815407845d3465a1a8feed94f24fc2fe84a578eb14401

Download Submit
C:\Users\Admin\AppData\Local\Temp\X5jGqiFaSS.bat

Filesize
198B

MD5
3d58dfa0976b5700c22c9ea17b7a8fde

SHA1
f7b5ddbc1c2b1eb9e93bb2d62ac01278f2809e41

SHA256
3eedfb467f5eec9a8998e35ea44c66effc2367e7ae3286829a6673becd77696b

SHA512
1c6496f88d940004306f56247bdc04b58d303919df7a19986a6b8159c0a01e7784e115c977dbf987f008ad9ef4fcb5406efe30672400ab10c9c4b565613da5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat

Filesize
198B

MD5
a46dd89b1260a12bc4fd2ca9facb22c2

SHA1
bc6fd726efa669f4a0ec9ecaa51564fe1157c8d6

SHA256
4d5b8cda62c185edf7adead3be28185558982472f42d688619b502bc2dd97693

SHA512
7fbebf8735decbcea5f0fc24f8e178cec545df3637719c6c1209cd575809aac26c6552f5097c0e0121d5c50f5e1257c3b137a24937f29de5749679e032a45b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat

Filesize
198B

MD5
f4a9ac785759602dd6f05d113988f2c2

SHA1
f61bc6c0a1cbf6a5e8765986e536020034a2bafa

SHA256
20ad198cb1ca83db583f3212a3b7f497eec048ec6db91f37de4b236be7c033a8

SHA512
13429d5fae97dfded9d8ac985d0ba9d197adb7575773fa56998868374861e38def13b7575913aa80ea4fa3b58a41b180c551d076a311d3ba248f63f4c3017748

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1on3avpv.txe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eKnLpNzAx9.bat

Filesize
198B

MD5
8ae9653b8d8b01e728d7cf0a12d55ee3

SHA1
66d716e8035e1871cd229b903b5415e9623a731a

SHA256
8f17b67831736a31adcd7d32666b406d35505f891694621d2ba0386fdd5e48fd

SHA512
326d8ca3bf8dedfa57699f6474bb02976636a375f6e8d1509ade16ec406a99cf14f175fd5ea883d976fa305eeb6068698761cd21b173ac4a6941e3390f5c73b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat

Filesize
198B

MD5
63df836b4edb114c3381898192d45f7c

SHA1
1d623be7259e6d6f881e7d2d7db7a55d88f49805

SHA256
61beda59e10228ebf7fb470fd33a10204abcabf83e0f7a3079ad2a73dac9df5e

SHA512
259354cb3013fefcd6c096e17e28398e8110a6270b555524b447f433ac1f3d3ee4de04e8c4d9dbff95b44e7e13c5f5ffa721ce8076fd3249bcd74071c04ffa79

Download Submit
C:\Users\Admin\AppData\Local\Temp\uq0hdwOOBc.bat

Filesize
198B

MD5
d08a223ba242cf5feabfea241a1f1e7a

SHA1
da1efd8b86cbaf920844af3822fd10a76fa9fe89

SHA256
0232c4face4c24a2fff0ca95baa0d9d271894b507cfe5f1084a856eecce60fab

SHA512
c07dfc43055f86f165bfaa7c19691ed3200cb48f187a2b7c55f0015d6063437b770422d2ac951dcdb002c39b68fad40bd0df94e83617eec92c67e002befd74cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat

Filesize
198B

MD5
646a544559c10ec514a43f2a03f01f6e

SHA1
e2a50917548e5907e40ebe9c1bff541c0e6d49c9

SHA256
c8d7688ade661059d1a09a4bf5f4b2c113d369bf71361f73fc8c75392468201a

SHA512
ec0184b8b0d4e2f90b05203288af054f18ccd2109964851994e7e0bd0d88b3832795bfd0c1e1978abfd1f2e5398480bbc2622d61fcd49654ee0a2f38ebde60a0

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1584-250-0x0000000001350000-0x0000000001362000-memory.dmp

Filesize
72KB

Download
memory/3340-301-0x0000000002850000-0x0000000002862000-memory.dmp

Filesize
72KB

Download
memory/3388-222-0x0000000002FC0000-0x0000000002FD2000-memory.dmp

Filesize
72KB

Download
memory/3388-229-0x000000001C9B0000-0x000000001CA51000-memory.dmp

Filesize
644KB

Download
memory/3600-51-0x0000016603B80000-0x0000016603BA2000-memory.dmp

Filesize
136KB

Download
memory/4052-288-0x00000000013E0000-0x00000000013F2000-memory.dmp

Filesize
72KB

Download
memory/4828-257-0x0000000002C10000-0x0000000002C22000-memory.dmp

Filesize
72KB

Download
memory/5064-17-0x0000000002730000-0x000000000273C000-memory.dmp

Filesize
48KB

Download
memory/5064-16-0x0000000002610000-0x000000000261C000-memory.dmp

Filesize
48KB

Download
memory/5064-15-0x000000001B830000-0x000000001B83C000-memory.dmp

Filesize
48KB

Download
memory/5064-14-0x0000000000CC0000-0x0000000000CD2000-memory.dmp

Filesize
72KB

Download
memory/5064-13-0x00000000003E0000-0x00000000004F0000-memory.dmp

Filesize
1.1MB

Download
memory/5064-12-0x00007FF878703000-0x00007FF878705000-memory.dmp

Filesize
8KB

Download