dcrat | a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe
Size

1.3MB
MD5

296df93c1575604177a1ccebbf2e50fd
SHA1

ca84c7f503d574a9a4be8b8855b70cb664a88841
SHA256

a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb
SHA512

777e8748fe382bc6412c8c4b49c8fd6592fe6d14328a716fd0e5b5eace615bfb1972edc0f90fbcfd2cc4a411de72c3db995a6b8160d6ffe0803404326bd9e567
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2900	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	2900	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9c-10.dat	dcrat
behavioral2/memory/2356-13-0x00000000001F0000-0x0000000000300000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe
2728	powershell.exe
2076	powershell.exe
3420	powershell.exe
5024	powershell.exe
1424	powershell.exe
3536	powershell.exe
528	powershell.exe
1832	powershell.exe
3540	powershell.exe
2272	powershell.exe
4304	powershell.exe
2916	powershell.exe
2308	powershell.exe
2240	powershell.exe
1636	powershell.exe
396	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 16 IoCs

pid	Process
2356	DllCommonsvc.exe
5612	dwm.exe
5024	dwm.exe
2896	dwm.exe
4192	dwm.exe
4440	dwm.exe
2916	dwm.exe
4188	dwm.exe
5744	dwm.exe
6060	dwm.exe
2712	dwm.exe
4032	dwm.exe
5216	dwm.exe
5040	dwm.exe
4008	dwm.exe
5448	dwm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
46	raw.githubusercontent.com
47	raw.githubusercontent.com
24	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
59	raw.githubusercontent.com
49	raw.githubusercontent.com
55	raw.githubusercontent.com
58	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
48	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\es-ES\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\DESIGNER\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\es-ES\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\Common Files\DESIGNER\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\System.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\diagnostics\scheduled\Maintenance\en-US\sihost.exe	DllCommonsvc.exe
File created	C:\Windows\LanguageOverlayCache\conhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dwm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4508	schtasks.exe
2040	schtasks.exe
3804	schtasks.exe
4192	schtasks.exe
3640	schtasks.exe
2932	schtasks.exe
1240	schtasks.exe
228	schtasks.exe
4784	schtasks.exe
3060	schtasks.exe
4176	schtasks.exe
3768	schtasks.exe
3948	schtasks.exe
2184	schtasks.exe
4516	schtasks.exe
4680	schtasks.exe
3604	schtasks.exe
4904	schtasks.exe
1544	schtasks.exe
4224	schtasks.exe
1536	schtasks.exe
1032	schtasks.exe
4160	schtasks.exe
5116	schtasks.exe
3040	schtasks.exe
2776	schtasks.exe
3364	schtasks.exe
3280	schtasks.exe
4428	schtasks.exe
888	schtasks.exe
708	schtasks.exe
116	schtasks.exe
404	schtasks.exe
3940	schtasks.exe
4324	schtasks.exe
836	schtasks.exe
4936	schtasks.exe
4080	schtasks.exe
5032	schtasks.exe
3688	schtasks.exe
3556	schtasks.exe
3340	schtasks.exe
1540	schtasks.exe
4376	schtasks.exe
4348	schtasks.exe
2540	schtasks.exe
1952	schtasks.exe
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
2356	DllCommonsvc.exe
1972	powershell.exe
1972	powershell.exe
3540	powershell.exe
3540	powershell.exe
2728	powershell.exe
2728	powershell.exe
4304	powershell.exe
4304	powershell.exe
2916	powershell.exe
2916	powershell.exe
1636	powershell.exe
3536	powershell.exe
3536	powershell.exe
1636	powershell.exe
396	powershell.exe
396	powershell.exe
2076	powershell.exe
2076	powershell.exe
2272	powershell.exe
2272	powershell.exe
2308	powershell.exe
2308	powershell.exe
2240	powershell.exe
2240	powershell.exe
5024	powershell.exe
5024	powershell.exe
3420	powershell.exe
3420	powershell.exe
1832	powershell.exe
1832	powershell.exe
528	powershell.exe
528	powershell.exe
1424	powershell.exe
1424	powershell.exe
5024	powershell.exe
1424	powershell.exe
1972	powershell.exe
2272	powershell.exe
2728	powershell.exe
2240	powershell.exe
3540	powershell.exe
4304	powershell.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	DllCommonsvc.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	5612	dwm.exe
Token: SeDebugPrivilege	5024	dwm.exe
Token: SeDebugPrivilege	2896	dwm.exe
Token: SeDebugPrivilege	4192	dwm.exe
Token: SeDebugPrivilege	4440	dwm.exe
Token: SeDebugPrivilege	2916	dwm.exe
Token: SeDebugPrivilege	4188	dwm.exe
Token: SeDebugPrivilege	5744	dwm.exe
Token: SeDebugPrivilege	6060	dwm.exe
Token: SeDebugPrivilege	2712	dwm.exe
Token: SeDebugPrivilege	4032	dwm.exe
Token: SeDebugPrivilege	5216	dwm.exe
Token: SeDebugPrivilege	5040	dwm.exe
Token: SeDebugPrivilege	4008	dwm.exe
Token: SeDebugPrivilege	5448	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3112	2740	a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe	83
PID 2740 wrote to memory of 3112	2740	a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe	83
PID 2740 wrote to memory of 3112	2740	a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe	83
PID 3112 wrote to memory of 4440	3112	WScript.exe	84
PID 3112 wrote to memory of 4440	3112	WScript.exe	84
PID 3112 wrote to memory of 4440	3112	WScript.exe	84
PID 4440 wrote to memory of 2356	4440	cmd.exe	86
PID 4440 wrote to memory of 2356	4440	cmd.exe	86
PID 2356 wrote to memory of 1832	2356	DllCommonsvc.exe	137
PID 2356 wrote to memory of 1832	2356	DllCommonsvc.exe	137
PID 2356 wrote to memory of 3540	2356	DllCommonsvc.exe	138
PID 2356 wrote to memory of 3540	2356	DllCommonsvc.exe	138
PID 2356 wrote to memory of 1636	2356	DllCommonsvc.exe	139
PID 2356 wrote to memory of 1636	2356	DllCommonsvc.exe	139
PID 2356 wrote to memory of 396	2356	DllCommonsvc.exe	140
PID 2356 wrote to memory of 396	2356	DllCommonsvc.exe	140
PID 2356 wrote to memory of 2272	2356	DllCommonsvc.exe	141
PID 2356 wrote to memory of 2272	2356	DllCommonsvc.exe	141
PID 2356 wrote to memory of 2916	2356	DllCommonsvc.exe	142
PID 2356 wrote to memory of 2916	2356	DllCommonsvc.exe	142
PID 2356 wrote to memory of 1972	2356	DllCommonsvc.exe	143
PID 2356 wrote to memory of 1972	2356	DllCommonsvc.exe	143
PID 2356 wrote to memory of 2076	2356	DllCommonsvc.exe	144
PID 2356 wrote to memory of 2076	2356	DllCommonsvc.exe	144
PID 2356 wrote to memory of 2728	2356	DllCommonsvc.exe	145
PID 2356 wrote to memory of 2728	2356	DllCommonsvc.exe	145
PID 2356 wrote to memory of 4304	2356	DllCommonsvc.exe	146
PID 2356 wrote to memory of 4304	2356	DllCommonsvc.exe	146
PID 2356 wrote to memory of 5024	2356	DllCommonsvc.exe	147
PID 2356 wrote to memory of 5024	2356	DllCommonsvc.exe	147
PID 2356 wrote to memory of 3420	2356	DllCommonsvc.exe	148
PID 2356 wrote to memory of 3420	2356	DllCommonsvc.exe	148
PID 2356 wrote to memory of 528	2356	DllCommonsvc.exe	157
PID 2356 wrote to memory of 528	2356	DllCommonsvc.exe	157
PID 2356 wrote to memory of 3536	2356	DllCommonsvc.exe	159
PID 2356 wrote to memory of 3536	2356	DllCommonsvc.exe	159
PID 2356 wrote to memory of 2240	2356	DllCommonsvc.exe	160
PID 2356 wrote to memory of 2240	2356	DllCommonsvc.exe	160
PID 2356 wrote to memory of 1424	2356	DllCommonsvc.exe	161
PID 2356 wrote to memory of 1424	2356	DllCommonsvc.exe	161
PID 2356 wrote to memory of 2308	2356	DllCommonsvc.exe	162
PID 2356 wrote to memory of 2308	2356	DllCommonsvc.exe	162
PID 2356 wrote to memory of 5096	2356	DllCommonsvc.exe	171
PID 2356 wrote to memory of 5096	2356	DllCommonsvc.exe	171
PID 5096 wrote to memory of 228	5096	cmd.exe	174
PID 5096 wrote to memory of 228	5096	cmd.exe	174
PID 5096 wrote to memory of 5612	5096	cmd.exe	181
PID 5096 wrote to memory of 5612	5096	cmd.exe	181
PID 5612 wrote to memory of 6124	5612	dwm.exe	189
PID 5612 wrote to memory of 6124	5612	dwm.exe	189
PID 6124 wrote to memory of 4348	6124	cmd.exe	191
PID 6124 wrote to memory of 4348	6124	cmd.exe	191
PID 6124 wrote to memory of 5024	6124	cmd.exe	193
PID 6124 wrote to memory of 5024	6124	cmd.exe	193
PID 5024 wrote to memory of 4936	5024	dwm.exe	195
PID 5024 wrote to memory of 4936	5024	dwm.exe	195
PID 4936 wrote to memory of 2932	4936	cmd.exe	198
PID 4936 wrote to memory of 2932	4936	cmd.exe	198
PID 4936 wrote to memory of 2896	4936	cmd.exe	201
PID 4936 wrote to memory of 2896	4936	cmd.exe	201
PID 2896 wrote to memory of 5208	2896	dwm.exe	203
PID 2896 wrote to memory of 5208	2896	dwm.exe	203
PID 5208 wrote to memory of 4784	5208	cmd.exe	205
PID 5208 wrote to memory of 4784	5208	cmd.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe
"C:\Users\Admin\AppData\Local\Temp\a9e2ecbc46b9191e0dd97fc5289ff737f45b5e5cb84218f4bab3a6b03ccb1bdb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Apply\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\DESIGNER\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\MsEdgeCrashpad\reports\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\es-ES\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IY5nER9bFr.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5096
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:228
      - C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BfyeXCadxk.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:6124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4348
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p6CE4ikEee.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2932
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lE88gYdR15.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4784
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LabqbH8bfv.bat"
        13⤵
        
        PID:1600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4268
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat"
        15⤵
        
        PID:2728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3640
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat"
        17⤵
        
        PID:2868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4544
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat"
        19⤵
        
        PID:5528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:228
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\410ZzJtAuR.bat"
        21⤵
        
        PID:5988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:5368
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:6060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat"
        23⤵
        
        PID:2448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1612
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z9xTb8lNHs.bat"
        25⤵
        
        PID:3940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4772
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat"
        27⤵
        
        PID:1156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1216
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat"
        29⤵
        
        PID:5240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:2776
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
        31⤵
        
        PID:3616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:3988
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat"
        33⤵
        
        PID:3076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:2916
        
        C:\Program Files\Common Files\DESIGNER\dwm.exe
        
        "C:\Program Files\Common Files\DESIGNER\dwm.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Saved Games\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\NetHood\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Apply\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\DESIGNER\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\providercommon\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Services\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Services\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\410ZzJtAuR.bat

Filesize
211B

MD5
4d6c28336a6bf0abbe66a5586a38de05

SHA1
3c08dac2c33dd2dbae08e0b5d54a6f8e4c12a9a4

SHA256
aba7a1eede6c087db318015981f754bfe988beb4ce16efdbd57b5808493b5abe

SHA512
88f76a538b573ae5ddf21be3b9abade39ca413c01e67fb47a006bbc7ef3848c1e45ff2dfec0d789ae7a2a8eeeefc06db6d7ea2e96ea418101559cb2392bf5d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat

Filesize
211B

MD5
aa76ffda948729d33c71e6479a817a7b

SHA1
2a6312047cbdb106f34798b58a2d74c842484602

SHA256
78038457287d14eda40e5604b2e5e30363b251b4bdf4d992f6ddf0b95e01a12a

SHA512
030ca3c4df3a2d4f98af9f787c86cb5a603198064b86df59e167827839c3129aebbed16af8c1b05f738a8488364fc8f446b2b53e8d0208742be87b5a421dbdcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat

Filesize
211B

MD5
bdb8d8814e94ad3ad0b1f142e99371ae

SHA1
04e7793cacaff7828e5415073e41ee4c58b3e6ec

SHA256
9d295c3c1535d4148c6158f5321daaf789c25285792fe2385cfcf654bca3020a

SHA512
44dac21439316ed29be56361e0c4482aeb50021afa0beb4b155144132bbecf63eaa6d852daadbf375db1acce35ba2b4278cdb2f1bfa4739bd5188a91eabf6b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BfyeXCadxk.bat

Filesize
211B

MD5
6e1a0008eec6e21af3fcf282b46b186e

SHA1
310405151644a931447c063b0228127ac3f235ad

SHA256
2d2a0a98b9205cc405b754b58b7b00ef3b1fde1b611c30af6a57d49482e0ad65

SHA512
eabf6a8e5e5917d6413a4d591aebb7c649000ceebcf7ca1dcb4606f94d5bc714f84cfbb47045bcac8c937588f0e7ec9e4b84946f1c251a1bde7d4514beb6f557

Download Submit
C:\Users\Admin\AppData\Local\Temp\IY5nER9bFr.bat

Filesize
211B

MD5
a550e54f161dc51cec0fe0c915c202c7

SHA1
e59882bcc0afe48b019d3888aff09ccff6502feb

SHA256
dba2c83d8f71d03d13d76d0f8dc6269b63b0a235a993d354e3ea37fcb7c9a547

SHA512
ecfd1ffbc0bcb2997895b742544bc3b9abe3fcaa4348fdde38dcb1fd25bb893c6b734036a4c6f63a41773e1325fde6eacdb61743c6f8523f605e316d60a1031b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LabqbH8bfv.bat

Filesize
211B

MD5
bf326b11e5ddf09055ef79a81156e55f

SHA1
f5526ad8f66821fc65d02cd0d96b2c3e765d8c63

SHA256
302a2525864f52e944c92f68ce3b4baae688bbcd736d49f44f24af7004d02156

SHA512
6332d8c6758a4368b91b6c83ddb4893e97eb020b6853f5775ebd4583e110d39d556d4e9ecc4d1b1959f6554605f0b8d1793ee488953aac2cb2975c89e50ac317

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat

Filesize
211B

MD5
e0001a98d71d26399c740ecf45720ce0

SHA1
3794fd5895dd44730f33d1d175d1caac530eb093

SHA256
c22a54be3673e75a9c0fefaed0fa79f09408886446f0b690f263ad1d500fef7a

SHA512
3b45a32637751c2eb136fd41125352940a7691723363c43fe2e08ed100787380fe1f5c5ee8e523825598ab006d4d17cabe33757af36d539322909c7bcbd5c01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat

Filesize
211B

MD5
fb006410a13296fa3518698a335e2d19

SHA1
ca03b5b4f8225085f7acf5e9bce8ca07f84addcc

SHA256
0dee0b535d757c2d7660990edea183638430e7f288532f6840280c81018d1c27

SHA512
4a54d0906769a6e8fb6e5ad186cdaf0ed7e200665726350103cc5b718295de1a9b1fd0925229d85e5e7c3443f17295e9cfe3b0dc66b7a330049c227fa5c2f258

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat

Filesize
211B

MD5
d334466f725d804db350927ccba264e8

SHA1
4f38116807868647f7376932a4dfe0e2afa6ebe1

SHA256
2f9206ed1a5b58e66c8f15d806f8c685459aaff5f0e46823b1828e92fc842137

SHA512
fd46fe9955dd74d9e99bc274a0ce9a936dd31b93f0508717715825200b7222d4cea711c67161268d1ffc86eb157a1310deea2d0efe94191871a4e52ad6f2872d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nru0nvr.y0n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lE88gYdR15.bat

Filesize
211B

MD5
94a2d99ca9cbb71404559f0085de0291

SHA1
a51427260e00cd7c3161617a60ca92106ca9d19c

SHA256
99abe5ae4bdf6b84cd74cc437f38dc6f4e7d7000bb7fb52287c3bc3e29b0ea6e

SHA512
84a4a37e2bec67ef2902f5f8de9d9fbd92c109794389c2b044b9fa5aac82e751a40639ec43035c2f4da1214ea8ad97c7b6d965782634ea602ba75f59e3316fcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat

Filesize
211B

MD5
314391dd03d7dce626578f2946710b75

SHA1
c6a1a8728701d8b8b377fecb36566cb38802bd2f

SHA256
c41e771f49289cb79c673b8b893cbf7d96d4c6c728a06f7263263de677aafe73

SHA512
3a7be17556d5f3e32ee368200c9b61f15ee2ac368168ba9404bcbfca7786280ca3d0a9beeaa8431046b46634ac254a3683003abee6c9aca68afac86a0753774c

Download Submit
C:\Users\Admin\AppData\Local\Temp\p6CE4ikEee.bat

Filesize
211B

MD5
6f98fb4812bf18ef7488a7ca05d0e13a

SHA1
b4bf5ae8749f1c90ef202c3e96b17ed5252e4a26

SHA256
ea2e393d805da47aed3769bb89342a3a88f525ced74959d8c936d6214518f51e

SHA512
cdeea6e13c25b6d41b9b3580f355a794f6b8cf3a249bb7ea29a15ce0d094562e537ec921a350974560aa4ac0fb501df873c37f447c7cbb9fb87c7e2fb57e3512

Download Submit
C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat

Filesize
211B

MD5
aed8895a3d1ba168aa79659352f647b3

SHA1
4f828cb8330e7e19449ee926fb13595c70157666

SHA256
2bca6eaf961b30ccb19b32a4780f352a1a72c528aed185e6a25b06416de87dd2

SHA512
6251941b4aebdff7b622255b7e25519b92c863790dc80e157ffc640c77046ed4ee2893b294f0f913b31a0e9c84e214692de4df50677d43351c3a23d7bfb2fa19

Download Submit
C:\Users\Admin\AppData\Local\Temp\z9xTb8lNHs.bat

Filesize
211B

MD5
850683068ee5f20916c9efbfb1f28420

SHA1
4e2c706395c429b84ad40f91860912b7c5c34279

SHA256
4ae0982879247301ee1671b3a791dcc260281c328b612c7a70b8f7d545c88854

SHA512
4406371debc791b4ccfc7667a294bcb940f97d38e785f65c73c14991f3a9b676c78a47261efcf96bf5e73895ea61af1d25bd414ad555ef80452f9a2f84d4999f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1972-60-0x0000015D57790000-0x0000015D577B2000-memory.dmp

Filesize
136KB

Download
memory/2356-16-0x000000001B620000-0x000000001B62C000-memory.dmp

Filesize
48KB

Download
memory/2356-13-0x00000000001F0000-0x0000000000300000-memory.dmp

Filesize
1.1MB

Download
memory/2356-14-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/2356-15-0x000000001B630000-0x000000001B63C000-memory.dmp

Filesize
48KB

Download
memory/2356-12-0x00007FFF28733000-0x00007FFF28735000-memory.dmp

Filesize
8KB

Download
memory/2356-17-0x000000001B640000-0x000000001B64C000-memory.dmp

Filesize
48KB

Download
memory/2712-311-0x000000001B890000-0x000000001B8A2000-memory.dmp

Filesize
72KB

Download
memory/2896-265-0x000000001B810000-0x000000001B912000-memory.dmp

Filesize
1.0MB

Download
memory/2916-287-0x000000001BB50000-0x000000001BC52000-memory.dmp

Filesize
1.0MB

Download
memory/2916-282-0x0000000000F90000-0x0000000000FA2000-memory.dmp

Filesize
72KB

Download
memory/4008-338-0x000000001B760000-0x000000001B772000-memory.dmp

Filesize
72KB

Download
memory/4188-294-0x000000001BA50000-0x000000001BB52000-memory.dmp

Filesize
1.0MB

Download
memory/4192-272-0x000000001C220000-0x000000001C322000-memory.dmp

Filesize
1.0MB

Download
memory/4440-279-0x000000001BEC0000-0x000000001BFC2000-memory.dmp

Filesize
1.0MB

Download
memory/5040-331-0x00000000015A0000-0x00000000015B2000-memory.dmp

Filesize
72KB

Download
memory/5216-324-0x00000000014C0000-0x00000000014D2000-memory.dmp

Filesize
72KB

Download
memory/5448-345-0x0000000001160000-0x0000000001172000-memory.dmp

Filesize
72KB

Download
memory/5612-246-0x0000000000900000-0x0000000000912000-memory.dmp

Filesize
72KB

Download
memory/5744-302-0x000000001BA30000-0x000000001BB32000-memory.dmp

Filesize
1.0MB

Download
memory/5744-297-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download