dcrat | 1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29

Analysis

max time kernel
145s
max time network
140s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe
Size

1.3MB
MD5

fa03023ff8b78e844471ce5523b86647
SHA1

fb45485f0db17f1bb696e441559a4ec045cea7a2
SHA256

1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29
SHA512

2daaf1873b6c31c15c241aa7f24977ff5882ea667b2a00a1b2449934ac3374b8a652704d6f3a8f2737c18153ac3a4fcb710adac84e3b28e9b3786b44ce75e9e6
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2936	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2936	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016b47-9.dat	dcrat
behavioral1/memory/3048-13-0x0000000000AE0000-0x0000000000BF0000-memory.dmp	dcrat
behavioral1/memory/2388-158-0x0000000000850000-0x0000000000960000-memory.dmp	dcrat
behavioral1/memory/900-218-0x0000000001370000-0x0000000001480000-memory.dmp	dcrat
behavioral1/memory/2204-397-0x00000000003B0000-0x00000000004C0000-memory.dmp	dcrat
behavioral1/memory/900-457-0x0000000000170000-0x0000000000280000-memory.dmp	dcrat
behavioral1/memory/1516-517-0x0000000000120000-0x0000000000230000-memory.dmp	dcrat
behavioral1/memory/2340-577-0x00000000011D0000-0x00000000012E0000-memory.dmp	dcrat
behavioral1/memory/1984-696-0x00000000001F0000-0x0000000000300000-memory.dmp	dcrat
behavioral1/memory/1964-756-0x0000000000D20000-0x0000000000E30000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe
2700	powershell.exe
2692	powershell.exe
1904	powershell.exe
1908	powershell.exe
2960	powershell.exe
2664	powershell.exe
2920	powershell.exe
2688	powershell.exe
2436	powershell.exe
860	powershell.exe
3064	powershell.exe
2308	powershell.exe
2616	powershell.exe
2632	powershell.exe
2760	powershell.exe
2624	powershell.exe
1832	powershell.exe
3068	powershell.exe
2656	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
3048	DllCommonsvc.exe
2388	DllCommonsvc.exe
900	DllCommonsvc.exe
1516	DllCommonsvc.exe
3024	DllCommonsvc.exe
2204	DllCommonsvc.exe
900	DllCommonsvc.exe
1516	DllCommonsvc.exe
2340	DllCommonsvc.exe
2192	DllCommonsvc.exe
1984	DllCommonsvc.exe
1964	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
1412	cmd.exe
1412	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
4	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
32	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\it-IT\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-ripbsyn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3eae274bc8057a96\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1892	schtasks.exe
2064	schtasks.exe
2376	schtasks.exe
1732	schtasks.exe
1460	schtasks.exe
2812	schtasks.exe
2092	schtasks.exe
3068	schtasks.exe
2640	schtasks.exe
2572	schtasks.exe
2888	schtasks.exe
848	schtasks.exe
908	schtasks.exe
2224	schtasks.exe
1468	schtasks.exe
2348	schtasks.exe
2644	schtasks.exe
1796	schtasks.exe
2372	schtasks.exe
2528	schtasks.exe
1272	schtasks.exe
2288	schtasks.exe
1148	schtasks.exe
1776	schtasks.exe
2396	schtasks.exe
1476	schtasks.exe
2928	schtasks.exe
2476	schtasks.exe
2824	schtasks.exe
1844	schtasks.exe
2976	schtasks.exe
2796	schtasks.exe
2720	schtasks.exe
1940	schtasks.exe
2352	schtasks.exe
2136	schtasks.exe
768	schtasks.exe
1284	schtasks.exe
2096	schtasks.exe
2844	schtasks.exe
3040	schtasks.exe
888	schtasks.exe
1416	schtasks.exe
2800	schtasks.exe
1232	schtasks.exe
2912	schtasks.exe
664	schtasks.exe
2216	schtasks.exe
2904	schtasks.exe
2696	schtasks.exe
2740	schtasks.exe
2488	schtasks.exe
2240	schtasks.exe
3044	schtasks.exe
1564	schtasks.exe
2084	schtasks.exe
1632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3048	DllCommonsvc.exe
3048	DllCommonsvc.exe
3048	DllCommonsvc.exe
3048	DllCommonsvc.exe
3048	DllCommonsvc.exe
2624	powershell.exe
2308	powershell.exe
2920	powershell.exe
2700	powershell.exe
2692	powershell.exe
860	powershell.exe
2760	powershell.exe
2688	powershell.exe
2632	powershell.exe
1908	powershell.exe
1904	powershell.exe
3064	powershell.exe
2664	powershell.exe
2616	powershell.exe
2440	powershell.exe
2960	powershell.exe
2656	powershell.exe
3068	powershell.exe
1832	powershell.exe
2436	powershell.exe
2388	DllCommonsvc.exe
900	DllCommonsvc.exe
1516	DllCommonsvc.exe
3024	DllCommonsvc.exe
2204	DllCommonsvc.exe
900	DllCommonsvc.exe
1516	DllCommonsvc.exe
2340	DllCommonsvc.exe
2192	DllCommonsvc.exe
1984	DllCommonsvc.exe
1964	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	DllCommonsvc.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2388	DllCommonsvc.exe
Token: SeDebugPrivilege	900	DllCommonsvc.exe
Token: SeDebugPrivilege	1516	DllCommonsvc.exe
Token: SeDebugPrivilege	3024	DllCommonsvc.exe
Token: SeDebugPrivilege	2204	DllCommonsvc.exe
Token: SeDebugPrivilege	900	DllCommonsvc.exe
Token: SeDebugPrivilege	1516	DllCommonsvc.exe
Token: SeDebugPrivilege	2340	DllCommonsvc.exe
Token: SeDebugPrivilege	2192	DllCommonsvc.exe
Token: SeDebugPrivilege	1984	DllCommonsvc.exe
Token: SeDebugPrivilege	1964	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1640	2036	1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe	30
PID 2036 wrote to memory of 1640	2036	1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe	30
PID 2036 wrote to memory of 1640	2036	1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe	30
PID 2036 wrote to memory of 1640	2036	1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe	30
PID 1640 wrote to memory of 1412	1640	WScript.exe	32
PID 1640 wrote to memory of 1412	1640	WScript.exe	32
PID 1640 wrote to memory of 1412	1640	WScript.exe	32
PID 1640 wrote to memory of 1412	1640	WScript.exe	32
PID 1412 wrote to memory of 3048	1412	cmd.exe	34
PID 1412 wrote to memory of 3048	1412	cmd.exe	34
PID 1412 wrote to memory of 3048	1412	cmd.exe	34
PID 1412 wrote to memory of 3048	1412	cmd.exe	34
PID 3048 wrote to memory of 3064	3048	DllCommonsvc.exe	93
PID 3048 wrote to memory of 3064	3048	DllCommonsvc.exe	93
PID 3048 wrote to memory of 3064	3048	DllCommonsvc.exe	93
PID 3048 wrote to memory of 2656	3048	DllCommonsvc.exe	94
PID 3048 wrote to memory of 2656	3048	DllCommonsvc.exe	94
PID 3048 wrote to memory of 2656	3048	DllCommonsvc.exe	94
PID 3048 wrote to memory of 2960	3048	DllCommonsvc.exe	95
PID 3048 wrote to memory of 2960	3048	DllCommonsvc.exe	95
PID 3048 wrote to memory of 2960	3048	DllCommonsvc.exe	95
PID 3048 wrote to memory of 2760	3048	DllCommonsvc.exe	96
PID 3048 wrote to memory of 2760	3048	DllCommonsvc.exe	96
PID 3048 wrote to memory of 2760	3048	DllCommonsvc.exe	96
PID 3048 wrote to memory of 2664	3048	DllCommonsvc.exe	97
PID 3048 wrote to memory of 2664	3048	DllCommonsvc.exe	97
PID 3048 wrote to memory of 2664	3048	DllCommonsvc.exe	97
PID 3048 wrote to memory of 2632	3048	DllCommonsvc.exe	98
PID 3048 wrote to memory of 2632	3048	DllCommonsvc.exe	98
PID 3048 wrote to memory of 2632	3048	DllCommonsvc.exe	98
PID 3048 wrote to memory of 2616	3048	DllCommonsvc.exe	99
PID 3048 wrote to memory of 2616	3048	DllCommonsvc.exe	99
PID 3048 wrote to memory of 2616	3048	DllCommonsvc.exe	99
PID 3048 wrote to memory of 2700	3048	DllCommonsvc.exe	100
PID 3048 wrote to memory of 2700	3048	DllCommonsvc.exe	100
PID 3048 wrote to memory of 2700	3048	DllCommonsvc.exe	100
PID 3048 wrote to memory of 2308	3048	DllCommonsvc.exe	101
PID 3048 wrote to memory of 2308	3048	DllCommonsvc.exe	101
PID 3048 wrote to memory of 2308	3048	DllCommonsvc.exe	101
PID 3048 wrote to memory of 2440	3048	DllCommonsvc.exe	102
PID 3048 wrote to memory of 2440	3048	DllCommonsvc.exe	102
PID 3048 wrote to memory of 2440	3048	DllCommonsvc.exe	102
PID 3048 wrote to memory of 2436	3048	DllCommonsvc.exe	103
PID 3048 wrote to memory of 2436	3048	DllCommonsvc.exe	103
PID 3048 wrote to memory of 2436	3048	DllCommonsvc.exe	103
PID 3048 wrote to memory of 860	3048	DllCommonsvc.exe	104
PID 3048 wrote to memory of 860	3048	DllCommonsvc.exe	104
PID 3048 wrote to memory of 860	3048	DllCommonsvc.exe	104
PID 3048 wrote to memory of 2624	3048	DllCommonsvc.exe	105
PID 3048 wrote to memory of 2624	3048	DllCommonsvc.exe	105
PID 3048 wrote to memory of 2624	3048	DllCommonsvc.exe	105
PID 3048 wrote to memory of 2920	3048	DllCommonsvc.exe	106
PID 3048 wrote to memory of 2920	3048	DllCommonsvc.exe	106
PID 3048 wrote to memory of 2920	3048	DllCommonsvc.exe	106
PID 3048 wrote to memory of 3068	3048	DllCommonsvc.exe	107
PID 3048 wrote to memory of 3068	3048	DllCommonsvc.exe	107
PID 3048 wrote to memory of 3068	3048	DllCommonsvc.exe	107
PID 3048 wrote to memory of 1908	3048	DllCommonsvc.exe	108
PID 3048 wrote to memory of 1908	3048	DllCommonsvc.exe	108
PID 3048 wrote to memory of 1908	3048	DllCommonsvc.exe	108
PID 3048 wrote to memory of 1904	3048	DllCommonsvc.exe	109
PID 3048 wrote to memory of 1904	3048	DllCommonsvc.exe	109
PID 3048 wrote to memory of 1904	3048	DllCommonsvc.exe	109
PID 3048 wrote to memory of 2688	3048	DllCommonsvc.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe
"C:\Users\Admin\AppData\Local\Temp\1671c9009460ddc43afb58503030d4c6c167de4df161593d7bd9ec2296f1dc29.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\MF\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HNp56RQuhc.bat"
        5⤵
        
        PID:3020
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3024
      - C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I4yJNRBzAA.bat"
        7⤵
        
        PID:1328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2696
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat"
        9⤵
        
        PID:2640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1236
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vdJwOJplm6.bat"
        11⤵
        
        PID:1800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:760
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hD3D8PLBZ9.bat"
        13⤵
        
        PID:2992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat"
        15⤵
        
        PID:2112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1588
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat"
        17⤵
        
        PID:2956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2720
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2sHl3bGdB9.bat"
        19⤵
        
        PID:1700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2820
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat"
        21⤵
        
        PID:2208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2972
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uGRILFBWR.bat"
        23⤵
        
        PID:1728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1632
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat"
        25⤵
        
        PID:3032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2780
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\My Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\it-IT\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\it-IT\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\it-IT\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\MF\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\MF\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\MF\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Local Settings\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Local Settings\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcd077e1ef4121178adb9b1236ff0038

SHA1
5cf809a88699821eedd459af1ad2af81dbada3bf

SHA256
d7460293f753002418f1ddd2154363bb6dee13a25dd8ff43a6bd838e62b61d29

SHA512
e1d25e1bc3aad880c84cfd5ddf5267f5160265a0c90e3cd6736c2965424c159bb2e7494321ff552743b1a3c58d5fff3b567fe16735886f9004afff084811f52d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03bf1e02ff5a1a1386117dcffd83ccf1

SHA1
2b8ce8124d8153f1b17f8e1dd09ccd44cda5d8a7

SHA256
d3c8392ffd76a5bb9172440855519c2c2c488510b9b80bc4fafc433f64758e7d

SHA512
55ca039507f1076d13e3172c216f8feeea8dbd952af81051d8dc1d34083d2fc544f01c000458a45c081c3fd8bfcb50891edbad7ab662c257d8071b214c4a455d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e83f7488e1f78a9fb5d45b8d6b7336e

SHA1
f24e553089c305a09a93c51e367ccea91469c8dc

SHA256
4e7c890ad85fc627e2a8050ec31be12ee0dd0aa391b93f7c0d03537573b7302d

SHA512
122a495c4d10c970ffab6531c1e72ceda9af8a44c13a277e5e61a9f10c2dfd80349718be6c1881bd90b1045df2ec42a0af4f74dd9edf1d0168c1c8ff45c1416b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6be6ddbca41812951b46d55d190ea572

SHA1
80f3aeb60bf8838c947ddfca90abef94fd658474

SHA256
3a0573ca891d6332362a74e080be674ad72710ee7dd2e517bb6c1f590a68cd8f

SHA512
5a728acb7ca21ee44818b7a5aa34534546ace61e612962e520ab9a900466cb0b589ee7656b0d7789af42ca79f09513c6003df3783e26de386bbfd094d7c041d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44e75bda6aeb7f2a0b4710359efb4020

SHA1
dc2a52ff61d11027c4e2959d2c46409c516ddedd

SHA256
77dba878f5368480f559ca9731a9f1844d60ed5f6211d80ee52fae7403b29b3b

SHA512
9e7ed2b26904eba000f9110fb51212baea44da844cdef360063ab6795c1813d79a4a00f9b5fc5c20ec32e293b67fe928827290f0ad67b7cdb1062b4825d6e1da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7a80353531cd18e37c52ed7a9c85fc4

SHA1
d7c74b5b5b7a7a70a06e2b1d63660e2105e21e42

SHA256
34a61bc688eb45c3c6343f59d2b05f66efe43050c80e166289d383eadfd3b927

SHA512
609b73095804cc3bb2aba9a8d2ab6e419d3a7bca8c321ad4af7637c77b55855fa980a8537b63cf1c9ac5da41703d55289fc771af7059808893fc33e3fa09d8dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b3228f3abbaf8170e9e4310e6f3d44b

SHA1
7d224637cdf4d3e2d9c4a27df744d079104c9153

SHA256
01cab9e3f61c4c1a28c55b023933eae3721eee42d0d1ff72f1e45d18c5e73152

SHA512
62e5fe1be387ea82cbe4b5bf047ad543aed7e72f6c78bc4f1f4e286a925a8b93c44611a6204632e9c20c512b9bd4c4861d652dc562c023e396e67b6239f8c546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9f2b159cf858e62705278e6e53340e8

SHA1
7ce619c18345d8375c2730d9af7c2986448beaaf

SHA256
063643f46018c160cfdfbef84d042d16b8aa4cf12cda42abb4a286207e456238

SHA512
e833f20b3f48c07dc6be92dd0d20d73df608e6061242ecbdee49898f9b7f33d1f78044547e348ec20be0487c72fc979e916410f997a36a31c2d799f7f4204f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe1b52a6c1a292ab17f2677cc38c59b6

SHA1
869304d06edf18480b317352a91c718bcd924e62

SHA256
bad2a5d484986fa6d7cfbeacdf6052bc283b54eb2e12d891b34e784d375dfcce

SHA512
0bab865ee0fa6c80c5dd720104004d1414a2e705a8e62689dcbc38000f29268034596f76667696f3a372648e0b2e25278dc69ad2e67fe8a385f4a1524f1be15f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2sHl3bGdB9.bat

Filesize
245B

MD5
46dee2db9a2b412c0b1eb27d2d2c5d49

SHA1
8b49f050699be3d7c04c04e409f8576632d94169

SHA256
aa03290467b3cd89e2f6c8247ffcd5a70ba016d9687828313870a90485479a42

SHA512
3564b34010d3d0ba3adda1e7f7734d1a860d69948b062df6e9af311361a87d3f6f269a02422f87207a37c1746f2d2de41908269d8cc11d4613d79a17686ecafe

Download Submit
C:\Users\Admin\AppData\Local\Temp\6uGRILFBWR.bat

Filesize
245B

MD5
e5bd6e74a1a0fa673f359157290a8841

SHA1
6f01f15a76966f8f2f2c4a7e36c72a6746308f54

SHA256
a422af9157c1b42bdeee82fcf47fb840be2b1ceb9d586c01caa5490de0e8f423

SHA512
114c5a5124bc8f7792661e62006a5166d138bf7f469cee83054d9be4996115c32cdf383a9a3539b4a92f320fa5a8b113aa70246a43eb2f968ff43b450186e92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17B7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HNp56RQuhc.bat

Filesize
245B

MD5
df106208dd3eb186cef0f82262da14b2

SHA1
3a1689382d78347db8e3f5dcc305eed639e932ed

SHA256
a3926c753e582eb87b47d1d714d182cc27c8b1010d09d0707612743a7c0254f7

SHA512
20b1c361c5e7fad94b7093eaf0c26532c5e8303138f76d00b61e6c9329504cb771685f65fee2035e66d146fbb3204f3a23e05148f819bd67ad404e7a66f6e97b

Download Submit
C:\Users\Admin\AppData\Local\Temp\I4yJNRBzAA.bat

Filesize
245B

MD5
daa876303fc82ab269865ffab5c9feb2

SHA1
ffbaf791fe0a0de8e1f95aa710359f64392a8326

SHA256
62734b73608d4fef055d2f1e2de0124d2d2c237fcea9fafce881852a9d3f7a74

SHA512
fcf564122eb3d57873708f82d71cbd10e5c1d6f4d572ba3d4272382f3d79424c021b9fc62cf543cfca17f344c952d9caa77d18c7eca88b6249352b081c13172c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OvjOVLkpjd.bat

Filesize
245B

MD5
5aabc5af415693eec7a1f64c6d459a97

SHA1
4b4b02f9d15c4093f0d4a510eda29f3d7eb09952

SHA256
a8eb808a2a0e039e73018900f633778bbe45e59c69ae8ca057f18436bf8df3d6

SHA512
646e2bf91a1bde5a1013e894feb70c3032dbe2178521b927859ec8cbb817705e782b3929b38cf21a4727f3b4c3b423555e70430d9656fa036444e3f8b3aeadca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17D9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ezHXLeVHih.bat

Filesize
245B

MD5
996b8a1eb6b7bce4993db2830395a935

SHA1
fa6e6753d007bfbcbc3058d070d1c2b53bcc2853

SHA256
e6c45e7e9f8302009bc9d8201826c99274e2a2171cce84812f6aafe48e551818

SHA512
2abd2d7eafbb8c19ba5fd1ac66bfb8958447339883dfce3dff7e4642390fa7cd5faff3347b63f84e833cc0a2c0d5058328316bbd2b4beffb1f8a88fb377da676

Download Submit
C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat

Filesize
245B

MD5
897447b5102167641ea52bb81a63d587

SHA1
eec87425aa4d5c85741e0c2ed7e196bface8e87a

SHA256
149261b37fd6ffcd7bb51b42450463afc26efd03d544a0c96b7773b6110959fd

SHA512
1d379fef4f869f27c953b5c7a137b1c1a5c2cc19f0e6de3545fcf010a83da7606a4a193a3fea1f43b51949ad72ea04e2b68c36dcaa5bdcc96679e131bd1c80a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hD3D8PLBZ9.bat

Filesize
245B

MD5
970f0a5b73c797726ec1abf670473184

SHA1
55cc8e44d90d9adf99e8ed068a6b97e61294f828

SHA256
b38cd7b891bcb8f0a41bac0f14275bbebe5971381486d2d7acdae883d2f5ac01

SHA512
24bd9dcce9affef460de9a10755c1ebedb3c1d6946e05c58ad5e0f2ed603600c880ec7b8c99fb037fe52c31dd3cfdc944e11406d3fb8296fb210ec8fe0b6bc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat

Filesize
245B

MD5
69805085906ab96b9c68a50e36973342

SHA1
2c22a6effa9a1d8ec53d5934f1b4c08dce09dfe9

SHA256
b0d0bb57887bed34edece456096f012238ed936a83f33d68f2a8e66fb7c7db22

SHA512
a84edb052a23b2925432ccf4e3b99c0d7099bc3c5db9a1e6764a172898cdd9e898e308bac630cd9c4e08d1819166a093735bcb607aad25f8edebf397ee90057b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat

Filesize
245B

MD5
1cf4f9391b7df3ad22e35998e3744743

SHA1
19487178fa2331d394363ed3484c56161926cb91

SHA256
8188f4a8ac858f72b38f5e79539367395d21705d9a90da71224d9bd5ecced215

SHA512
9742ef56812a0b0f0b990d0de899ef42e4cfb3ba243c48321daaddc601bb2b5cc5ef8cf6c0c97c2978f493e59b16e010a22039b8f2be9679f032805cbaed2a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdJwOJplm6.bat

Filesize
245B

MD5
fc0415525d08f5a16a3a9052916fad29

SHA1
ff283b7aea66251bd272a9678cf5003f0372f2ec

SHA256
bf8fbac341a33753dd953ab3a2c6d7c19b254714b45ce2b5b6a78847dd4d2798

SHA512
9a54b65abade15c4d9bb4bf67d9a7b89a8712c3d5cd3fefaf0fd6c45f17aaeade78bef9dbf277aad73653a6331e5507ff8e9a7224db3bfa4bca4c568d61e6ff9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RU7AVI59OSA2FU666UD9.temp

Filesize
7KB

MD5
b400b66a229fae31585678aae3537767

SHA1
ee518fb71ecb94f115721001a6a0a6c75e2a5d2b

SHA256
d53ea973a1846f7f7750fb0f796cbef762cf1bd53cb689efb02aa7eb4e5a7c63

SHA512
2f2639d08dd6d0a53f566a5ed84b0774bdf053078f7945eab701d893aca8cd7df3f0e393d45bdb3e104cb9b2d33f1ef6f04762144a833115e49247621ac49c04

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/900-218-0x0000000001370000-0x0000000001480000-memory.dmp

Filesize
1.1MB

Download
memory/900-457-0x0000000000170000-0x0000000000280000-memory.dmp

Filesize
1.1MB

Download
memory/1516-517-0x0000000000120000-0x0000000000230000-memory.dmp

Filesize
1.1MB

Download
memory/1964-756-0x0000000000D20000-0x0000000000E30000-memory.dmp

Filesize
1.1MB

Download
memory/1984-696-0x00000000001F0000-0x0000000000300000-memory.dmp

Filesize
1.1MB

Download
memory/2204-397-0x00000000003B0000-0x00000000004C0000-memory.dmp

Filesize
1.1MB

Download
memory/2308-103-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2340-577-0x00000000011D0000-0x00000000012E0000-memory.dmp

Filesize
1.1MB

Download
memory/2388-158-0x0000000000850000-0x0000000000960000-memory.dmp

Filesize
1.1MB

Download
memory/2388-159-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2624-98-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/3024-337-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/3048-17-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Filesize
48KB

Download
memory/3048-16-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/3048-15-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Filesize
48KB

Download
memory/3048-14-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/3048-13-0x0000000000AE0000-0x0000000000BF0000-memory.dmp

Filesize
1.1MB

Download