dcrat | 43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe
Size

1.3MB
MD5

bfc6b5cc8e374433b2902835bf1e2e31
SHA1

7bebcd9f7bae8965f7f4ed38ab17a468ae760168
SHA256

43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042
SHA512

b536e3d1c740907740ee3ef914e73797d8d95c92ee3e8bfe6931bbc47a6a74abee72e8c2d50d934e99876ecd9ff3e4907f6d620ad213b0302693ee2adc69d5f4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 60 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2660	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2660	schtasks.exe	35

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016aa9-9.dat	dcrat
behavioral1/memory/320-13-0x00000000000B0000-0x00000000001C0000-memory.dmp	dcrat
behavioral1/memory/1520-108-0x0000000000E20000-0x0000000000F30000-memory.dmp	dcrat
behavioral1/memory/2756-296-0x0000000000FA0000-0x00000000010B0000-memory.dmp	dcrat
behavioral1/memory/1704-415-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/1764-475-0x0000000001200000-0x0000000001310000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2268	powershell.exe
2384	powershell.exe
2644	powershell.exe
2368	powershell.exe
2096	powershell.exe
2936	powershell.exe
344	powershell.exe
2024	powershell.exe
2948	powershell.exe
2584	powershell.exe
2724	powershell.exe
1588	powershell.exe
2596	powershell.exe
2912	powershell.exe
2740	powershell.exe
2356	powershell.exe
656	powershell.exe
2960	powershell.exe
320	powershell.exe
2364	powershell.exe
2932	powershell.exe
2388	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
320	DllCommonsvc.exe
1764	DllCommonsvc.exe
1520	dllhost.exe
3900	dllhost.exe
2756	dllhost.exe
3336	dllhost.exe
1704	dllhost.exe
1764	dllhost.exe
3828	dllhost.exe
2396	dllhost.exe
3136	dllhost.exe
372	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2636	cmd.exe
2636	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
33	raw.githubusercontent.com
9	raw.githubusercontent.com
23	raw.githubusercontent.com
29	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
26	raw.githubusercontent.com
36	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\images\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\lib\fonts\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\lib\fonts\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\MSBuild\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\101b941d020240	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 60 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1736	schtasks.exe
2664	schtasks.exe
1924	schtasks.exe
2956	schtasks.exe
2720	schtasks.exe
1788	schtasks.exe
880	schtasks.exe
2952	schtasks.exe
1744	schtasks.exe
2228	schtasks.exe
2500	schtasks.exe
2236	schtasks.exe
3000	schtasks.exe
2852	schtasks.exe
1616	schtasks.exe
3020	schtasks.exe
2040	schtasks.exe
2516	schtasks.exe
2928	schtasks.exe
1884	schtasks.exe
1176	schtasks.exe
2664	schtasks.exe
2192	schtasks.exe
2328	schtasks.exe
2572	schtasks.exe
2844	schtasks.exe
2076	schtasks.exe
372	schtasks.exe
2380	schtasks.exe
828	schtasks.exe
2848	schtasks.exe
2036	schtasks.exe
2176	schtasks.exe
2576	schtasks.exe
1892	schtasks.exe
644	schtasks.exe
2932	schtasks.exe
2208	schtasks.exe
876	schtasks.exe
2424	schtasks.exe
2696	schtasks.exe
1580	schtasks.exe
1720	schtasks.exe
992	schtasks.exe
2804	schtasks.exe
1860	schtasks.exe
1084	schtasks.exe
2708	schtasks.exe
2156	schtasks.exe
2888	schtasks.exe
2564	schtasks.exe
972	schtasks.exe
2748	schtasks.exe
832	schtasks.exe
2784	schtasks.exe
1592	schtasks.exe
2876	schtasks.exe
2544	schtasks.exe
1600	schtasks.exe
2920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
320	DllCommonsvc.exe
2268	powershell.exe
2596	powershell.exe
1588	powershell.exe
1764	DllCommonsvc.exe
1764	DllCommonsvc.exe
1764	DllCommonsvc.exe
1764	DllCommonsvc.exe
1764	DllCommonsvc.exe
2960	powershell.exe
2356	powershell.exe
2932	powershell.exe
2024	powershell.exe
656	powershell.exe
344	powershell.exe
2740	powershell.exe
2584	powershell.exe
2096	powershell.exe
2948	powershell.exe
2936	powershell.exe
2912	powershell.exe
2364	powershell.exe
2368	powershell.exe
2384	powershell.exe
2644	powershell.exe
2724	powershell.exe
2388	powershell.exe
320	powershell.exe
1520	dllhost.exe
3900	dllhost.exe
2756	dllhost.exe
3336	dllhost.exe
1704	dllhost.exe
1764	dllhost.exe
3828	dllhost.exe
2396	dllhost.exe
3136	dllhost.exe
372	dllhost.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	DllCommonsvc.exe
Token: SeDebugPrivilege	1764	DllCommonsvc.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	344	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	1520	dllhost.exe
Token: SeDebugPrivilege	3900	dllhost.exe
Token: SeDebugPrivilege	2756	dllhost.exe
Token: SeDebugPrivilege	3336	dllhost.exe
Token: SeDebugPrivilege	1704	dllhost.exe
Token: SeDebugPrivilege	1764	dllhost.exe
Token: SeDebugPrivilege	3828	dllhost.exe
Token: SeDebugPrivilege	2396	dllhost.exe
Token: SeDebugPrivilege	3136	dllhost.exe
Token: SeDebugPrivilege	372	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2488	2464	JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe	31
PID 2464 wrote to memory of 2488	2464	JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe	31
PID 2464 wrote to memory of 2488	2464	JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe	31
PID 2464 wrote to memory of 2488	2464	JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe	31
PID 2488 wrote to memory of 2636	2488	WScript.exe	32
PID 2488 wrote to memory of 2636	2488	WScript.exe	32
PID 2488 wrote to memory of 2636	2488	WScript.exe	32
PID 2488 wrote to memory of 2636	2488	WScript.exe	32
PID 2636 wrote to memory of 320	2636	cmd.exe	34
PID 2636 wrote to memory of 320	2636	cmd.exe	34
PID 2636 wrote to memory of 320	2636	cmd.exe	34
PID 2636 wrote to memory of 320	2636	cmd.exe	34
PID 320 wrote to memory of 2268	320	DllCommonsvc.exe	42
PID 320 wrote to memory of 2268	320	DllCommonsvc.exe	42
PID 320 wrote to memory of 2268	320	DllCommonsvc.exe	42
PID 320 wrote to memory of 2596	320	DllCommonsvc.exe	43
PID 320 wrote to memory of 2596	320	DllCommonsvc.exe	43
PID 320 wrote to memory of 2596	320	DllCommonsvc.exe	43
PID 320 wrote to memory of 1588	320	DllCommonsvc.exe	44
PID 320 wrote to memory of 1588	320	DllCommonsvc.exe	44
PID 320 wrote to memory of 1588	320	DllCommonsvc.exe	44
PID 320 wrote to memory of 1764	320	DllCommonsvc.exe	48
PID 320 wrote to memory of 1764	320	DllCommonsvc.exe	48
PID 320 wrote to memory of 1764	320	DllCommonsvc.exe	48
PID 1764 wrote to memory of 2960	1764	DllCommonsvc.exe	103
PID 1764 wrote to memory of 2960	1764	DllCommonsvc.exe	103
PID 1764 wrote to memory of 2960	1764	DllCommonsvc.exe	103
PID 1764 wrote to memory of 2936	1764	DllCommonsvc.exe	104
PID 1764 wrote to memory of 2936	1764	DllCommonsvc.exe	104
PID 1764 wrote to memory of 2936	1764	DllCommonsvc.exe	104
PID 1764 wrote to memory of 2912	1764	DllCommonsvc.exe	105
PID 1764 wrote to memory of 2912	1764	DllCommonsvc.exe	105
PID 1764 wrote to memory of 2912	1764	DllCommonsvc.exe	105
PID 1764 wrote to memory of 2384	1764	DllCommonsvc.exe	106
PID 1764 wrote to memory of 2384	1764	DllCommonsvc.exe	106
PID 1764 wrote to memory of 2384	1764	DllCommonsvc.exe	106
PID 1764 wrote to memory of 2740	1764	DllCommonsvc.exe	107
PID 1764 wrote to memory of 2740	1764	DllCommonsvc.exe	107
PID 1764 wrote to memory of 2740	1764	DllCommonsvc.exe	107
PID 1764 wrote to memory of 2356	1764	DllCommonsvc.exe	108
PID 1764 wrote to memory of 2356	1764	DllCommonsvc.exe	108
PID 1764 wrote to memory of 2356	1764	DllCommonsvc.exe	108
PID 1764 wrote to memory of 344	1764	DllCommonsvc.exe	109
PID 1764 wrote to memory of 344	1764	DllCommonsvc.exe	109
PID 1764 wrote to memory of 344	1764	DllCommonsvc.exe	109
PID 1764 wrote to memory of 2024	1764	DllCommonsvc.exe	110
PID 1764 wrote to memory of 2024	1764	DllCommonsvc.exe	110
PID 1764 wrote to memory of 2024	1764	DllCommonsvc.exe	110
PID 1764 wrote to memory of 320	1764	DllCommonsvc.exe	111
PID 1764 wrote to memory of 320	1764	DllCommonsvc.exe	111
PID 1764 wrote to memory of 320	1764	DllCommonsvc.exe	111
PID 1764 wrote to memory of 2644	1764	DllCommonsvc.exe	112
PID 1764 wrote to memory of 2644	1764	DllCommonsvc.exe	112
PID 1764 wrote to memory of 2644	1764	DllCommonsvc.exe	112
PID 1764 wrote to memory of 2948	1764	DllCommonsvc.exe	113
PID 1764 wrote to memory of 2948	1764	DllCommonsvc.exe	113
PID 1764 wrote to memory of 2948	1764	DllCommonsvc.exe	113
PID 1764 wrote to memory of 656	1764	DllCommonsvc.exe	114
PID 1764 wrote to memory of 656	1764	DllCommonsvc.exe	114
PID 1764 wrote to memory of 656	1764	DllCommonsvc.exe	114
PID 1764 wrote to memory of 2364	1764	DllCommonsvc.exe	115
PID 1764 wrote to memory of 2364	1764	DllCommonsvc.exe	115
PID 1764 wrote to memory of 2364	1764	DllCommonsvc.exe	115
PID 1764 wrote to memory of 2584	1764	DllCommonsvc.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43dd3ea9d558395804af6d217d83062cef627a9867a37dc707372be27f4a0042.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\spoolsv.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteDesktops\dwm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\lib\fonts\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\Templates\1033\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\lsm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\audiodg.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\System.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
      - C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
        7⤵
        
        PID:3820
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3852
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat"
        9⤵
        
        PID:2068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1644
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"
        11⤵
        
        PID:1552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1632
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QSfwyRFOJU.bat"
        13⤵
        
        PID:2340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2804
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qX4ufk0Q6M.bat"
        15⤵
        
        PID:2152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1784
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat"
        17⤵
        
        PID:3568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3860
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fmTXnddwCX.bat"
        19⤵
        
        PID:2112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4004
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
        21⤵
        
        PID:2400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3096
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RkPY472Oq9.bat"
        23⤵
        
        PID:2160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1676
        
        C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"
        25⤵
        
        PID:2100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\images\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\images\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteDesktops\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre7\lib\fonts\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\fonts\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre7\lib\fonts\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Templates\1033\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Templates\1033\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Templates\1033\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Links\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Links\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\L2Schemas\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\browser\features\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a04bbac92e9b284eec4e603f4d5e5d0

SHA1
0c1afe6d94e6a829648bd3fd3bba7a2de585e772

SHA256
23ab933aac5230cce2429290300fa3eb3d6ec4036a75986eaf4b2be3ff3d23ed

SHA512
aa7c5b6fab06e2d29a4ccdb682228fa93805e65a022d072f8346fa7a75ffe0cff2ca66e5d4a3ee621ef91c864699732d1d028dc82e1addc45737bf780fb197e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c567b12c6dc09b617c4361ca0bd645f

SHA1
de26ff4905b3ed759d70e955db0f41a442f388bb

SHA256
311a6dca764c243f164c04744d7ce7be720e9d31f103cce0d0c82cdc938e30ed

SHA512
2573ac5b087add38de15c84ff449b611fe99c1194a24dab0d7541237e687b02da01b024a0ecebb134d355a5c173ef0c14d5390f0099ececd49c7c0d0d8a80e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d61234c3d8d808b50b39ddf86fa59283

SHA1
8032a797a7f55c5e8e20b421a315005ec2ad69e3

SHA256
e4694c4b1f1aad4722d0712126a07795e081f95f4efe3b61ed149029fbcd8950

SHA512
90043870081418a712aa7f34bb8cfc89c6cc1e56096a31a724c6647aee5443cc8d9b9fa37121405908a460016b882447cd8bf346418e6b5086878d07739e59b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f3b32e13384a38e825acacd04f849d5

SHA1
c9835db3c945c4bd3053b311ebf62a19c418cf8d

SHA256
51846e9213b3885542dc3729e1a130c4daba3900a089c124eb8d839971f1ef8a

SHA512
b8d7d4fd34f297426b602f9bd5beea98748fdff1558bfdd6c2f8f5d80ec77c43c5c5965472677d36696e499da3c41bc18198b168aca885fff748745eff4b373c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acd4de1853759279e4ac4caaca5f9f0f

SHA1
11d5b5267931c078a432103b8457ab96fc692928

SHA256
4a9583fa25f95e094ae599b0311382d6d9ef2babdda19bb68ef8c5336c5762a2

SHA512
6f1d4389bec39793ed7d91be7f08e2b814fbd4f962cb5ec9db32d3ba70504186fc9dd702d440d3f046ed3cd5e32cf29d44a297bdd8b92c4bf84f714fec348d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98b192294f7493c4662c05453d7e225e

SHA1
05d8347c62344e0526c4a0a4ef92736cdd3d40c3

SHA256
d902a666a190d474484c288567665148e673feb40dbdc55290a9d60cd565d73e

SHA512
a0f77c93944b45bf9cb39a7f1cdb2e580f2684387a82234551681df050f0c417e7c5b69fce959ab5e1cfa98805b0a5d0f7ac9a2278fd9751d3cd80849920b752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93c7f99d0e84447bdf72ddfceb2c91a5

SHA1
7b30d1014142fed9d81df05e52dcac2a7af98971

SHA256
2a29e8e1ba3891d68fa948f006c9970ed1f6e4e80b61cb1d651e6d8aa5b9e4cc

SHA512
7831590f8dcc60e847f7107a5d3ea50cd75d9f2ffbd73413b2f0ed236ef94b97c628ce002b7b496d034dc22199fdd93588832438cf4200eac72ae68139dd6376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5db00cdc8499e33444a6f178a987c070

SHA1
9d50167ea2a166ecbc3b76c29a3d95a76667347c

SHA256
aa3e0357d29d259ceb8c4af8c5506cc4a84e243a65cb78d3e947c81960e66974

SHA512
9ef96ec92401a2fd1c223759c902ac3daad83e42228682946e171c5571babb56e05dfd8d2725b7fb69b5b420d0290bf15592f64ed3c71b54e0880dde7c0bb1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf14078e2962e4a107f436d489bc1914

SHA1
70052b688482f23551da00b3af5b17ceaeef49c7

SHA256
dad9778ef783c7169d9255720854a5a6bc098ee6ae3421f9f96dff4ff4d15677

SHA512
6f73f211343fc3dc65b020ab2d4f95036da0f8693cc68b1696604db6c627dcd580a7a7ece76359d2f55a5cc92376d51437bcceff566a114e12576883b90d660e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3545.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat

Filesize
226B

MD5
8d71f2b9998a5a4503a3968ad9b23a31

SHA1
bfb3f9ef31258b09fb927bd9553e7b1bf9629acb

SHA256
b190c0f297ee05ff7c92dfd6fdb10d9dc88799b4184dc84a3d5304f74e2cef07

SHA512
7411161801f2af0493d199e06071789295d347c805b60302d38c787d54a292d45a69291dcd621f63e71bc30bd059213cd585bb3abbf71a430288ead3a157dd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSfwyRFOJU.bat

Filesize
226B

MD5
0562a79165456ba89e6864506966c92e

SHA1
c36ed4a3be0e606da7727bc8ff946371765385bc

SHA256
31271121c2bcfffdc255c7b9f7fd1ab4464660fd5fde01c0644d814efd5552d0

SHA512
11060854e5aff9fd40a2cc94c9df34e40ee57839cb0d9b9c8848cf3eb8e28e1821884462812c3fa28a600bdf6ca0bff53ec66495548f1f5fd165ce3d062b3ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RkPY472Oq9.bat

Filesize
226B

MD5
21c56154d35af13c315147b9b3b0dbae

SHA1
f70cb4f693ee2d6a8f405893d549b6d42e18350e

SHA256
12186ea787bd23c8793b0d926cd73bffb26a801cf9b13b2bce4678515aae6944

SHA512
27f75670e522bb35fdf5a1cfcee97e7dc0ba73adf588be15b7c9809e01c8802c2b5bd61f13591d7778d95a0606f8036a512f8bd9240506b6ce6452cad53f7cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3567.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fmTXnddwCX.bat

Filesize
226B

MD5
67f5874301d98d1fb4687e79a425e57e

SHA1
5f125ad8df3ac4b3dc33c017c552b6ead4e3f60b

SHA256
7ed36b666ff776eef4717276782587eac105cd182f573a3d2c23085aed0be185

SHA512
fd6ce71075f4e082b7b22b07099cdf690e5d5a92c2a04328a10242b2008f03507e88ee6ba4ac9abea55684db5031d8bf45af3a09aadc00d7ded23f5323253d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat

Filesize
226B

MD5
3165ba4b66ea3c2fa81b6de74e1f1a2b

SHA1
7c7f0b74c0bb9314267f2afefa351ba124d63694

SHA256
085bcc60bb332ca9b21ec2df4079e0a44d7601cb17f2feb211375ab75339da76

SHA512
de10ad70581424d00a75eb9c466e075bb6509e7efb29b744a8d1a0db8ef1b110f7d5bf17ad22a9f9940bbec6f0a3c21136793659dd79f19bfe5ffb3b0ecb2805

Download Submit
C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat

Filesize
226B

MD5
5bd78bc5c53c0af1f2af3a94d7f1c9b4

SHA1
f8a669d7e62a538056dc3b25fd65e2c021db5e17

SHA256
5fa5ea1a8d03066936006a94eec94cf045639ce24948c56dc4b75c3154c5777e

SHA512
facfebe7457ca2fe65ca1d244acfab8d9549cf2d105bad7b71558846285759156001b173e4d22286f70bd38e1858b16f2686956c0876db641d1593a7604c6dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat

Filesize
226B

MD5
d27f8218bc57f360faa17d72806e743d

SHA1
26d7d83ac6667d1f0cd18ee470510b61e0a25b8a

SHA256
16b5fbc129187c4bdce7031e99d47ea04b1f9a5d4212aefa581d939a08c3c5fe

SHA512
4805cb21c0e95b9e0aca6ba8d54bcabc3f931b1868a7d0ab54182a849dc7f4f152b2d7ee1e5499679efb9efff34ca299beaead8409c0b8e842f7dd059bb1ef8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat

Filesize
226B

MD5
c0ab47abd9d927d51fe890284fb881f2

SHA1
2f4ab0085ecc1b3b3a5613fb39956bf4ccdb2d69

SHA256
02d3ee3f26980873ddeb987f7b0664b9eeaf3ef65716ab3be18b4d75fa362254

SHA512
31bc8ceb5dd2b8ac3584b50d308bd09c6be81ea6c813590ccb62b4f90deac870014aed28b61c46a3b1a036b702670dfd35a3119284702f4c84d64547466fe56c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qX4ufk0Q6M.bat

Filesize
226B

MD5
4677868e337ef2e724b8348047d9b892

SHA1
ebcb1b48f740521ea78b6832df2f15e4a824ad5f

SHA256
5a78c79783f19f52c4b4148b7c33886611e512c73af2988ec98d51f8e72330af

SHA512
6adee8da2ceda1c13008794e0ba48a13d59475978b300fb87c369a8547f43d3d24335d640dc05191fe0fab26376e3ea3d789e2dced752773ea9aaa77c00127b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat

Filesize
226B

MD5
dfacc8ea5a6ea1f81a0b0b6c8f3d8df1

SHA1
715cb22c04027b1b87ff4d8390e9b3cd95f4808c

SHA256
3f56f41423c24c88b5781f2eb5f1f2a9c982937d332dd0d6e4c1524a48a7524b

SHA512
35c093e2ab4a04f3698b46468ad24166c5ed0d6254144b23b84aed7f5403be6b889ae082ec13b8d910dc70e1719e1b7b6e3941bb739db63f638da95fc02f2dd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e3ffca09b8469af7aea9c20827a044db

SHA1
2dc004feafbb6aea9ec65350fbe4fbf960a17fbb

SHA256
c827d8f8a60ee2fd8747db6789836b8ba672e54a7ec5ce80ed067f083a9a0b2b

SHA512
79a5447b977812006145d658ebb347c392c7439a2da1b600bc9d29eabfd9ca9a58a4cad75fe4752ad1e07fe8418793c37af964ff37abb88cc22c579e088ab0cf

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/320-17-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/320-16-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/320-15-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/320-14-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/320-13-0x00000000000B0000-0x00000000001C0000-memory.dmp

Filesize
1.1MB

Download
memory/372-712-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1520-108-0x0000000000E20000-0x0000000000F30000-memory.dmp

Filesize
1.1MB

Download
memory/1704-415-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/1764-475-0x0000000001200000-0x0000000001310000-memory.dmp

Filesize
1.1MB

Download
memory/2596-38-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2596-37-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2756-296-0x0000000000FA0000-0x00000000010B0000-memory.dmp

Filesize
1.1MB

Download
memory/2960-90-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2960-91-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download