dcrat | 471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe
Size

1.3MB
MD5

372658c007c215675bfb2ac15e988ed4
SHA1

4d9887cd9e58fe2440222360664e38d737119077
SHA256

471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3
SHA512

8e7fa37ba3e5badaab7736daa7e913b803f840dda7e6ce21263db55588b9944d66a1ae75a2b154a75d0dc073ab438c76c14ffe5f6e2bdbc3f8b9ff736356fa7d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2616	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2616	schtasks.exe	34

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000173f3-12.dat	dcrat
behavioral1/memory/2812-13-0x0000000000BD0000-0x0000000000CE0000-memory.dmp	dcrat
behavioral1/memory/2780-128-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat
behavioral1/memory/680-208-0x0000000000140000-0x0000000000250000-memory.dmp	dcrat
behavioral1/memory/1852-267-0x0000000000D40000-0x0000000000E50000-memory.dmp	dcrat
behavioral1/memory/620-327-0x00000000001F0000-0x0000000000300000-memory.dmp	dcrat
behavioral1/memory/2116-387-0x0000000000F90000-0x00000000010A0000-memory.dmp	dcrat
behavioral1/memory/1692-447-0x0000000000130000-0x0000000000240000-memory.dmp	dcrat
behavioral1/memory/1852-507-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat
behavioral1/memory/2960-686-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/1668-744-0x0000000000870000-0x0000000000980000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1788	powershell.exe
2032	powershell.exe
1792	powershell.exe
2464	powershell.exe
484	powershell.exe
2004	powershell.exe
2852	powershell.exe
2216	powershell.exe
1264	powershell.exe
2280	powershell.exe
2600	powershell.exe
1316	powershell.exe
2980	powershell.exe
1804	powershell.exe
880	powershell.exe
2200	powershell.exe
1796	powershell.exe
1784	powershell.exe
2456	powershell.exe
2920	powershell.exe
2036	powershell.exe
2776	powershell.exe
1472	powershell.exe
1928	powershell.exe
1624	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2812	DllCommonsvc.exe
2780	DllCommonsvc.exe
680	DllCommonsvc.exe
1852	DllCommonsvc.exe
620	DllCommonsvc.exe
2116	DllCommonsvc.exe
1692	DllCommonsvc.exe
1852	DllCommonsvc.exe
1472	DllCommonsvc.exe
1828	DllCommonsvc.exe
2960	DllCommonsvc.exe
1668	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2848	cmd.exe
2848	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
24	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\886983d96e3d3e	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\system\taskhost.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\system\taskhost.exe	DllCommonsvc.exe
File created	C:\Windows\system\b75386f1303e64	DllCommonsvc.exe
File created	C:\Windows\de-DE\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\system\conhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2408	schtasks.exe
1572	schtasks.exe
1104	schtasks.exe
2488	schtasks.exe
3040	schtasks.exe
2276	schtasks.exe
1956	schtasks.exe
2500	schtasks.exe
2120	schtasks.exe
2576	schtasks.exe
3020	schtasks.exe
768	schtasks.exe
800	schtasks.exe
2800	schtasks.exe
1760	schtasks.exe
2964	schtasks.exe
1632	schtasks.exe
1968	schtasks.exe
1976	schtasks.exe
2280	schtasks.exe
2976	schtasks.exe
2704	schtasks.exe
2676	schtasks.exe
812	schtasks.exe
1860	schtasks.exe
1556	schtasks.exe
2392	schtasks.exe
2568	schtasks.exe
2216	schtasks.exe
1964	schtasks.exe
3024	schtasks.exe
1692	schtasks.exe
2508	schtasks.exe
632	schtasks.exe
2008	schtasks.exe
2892	schtasks.exe
2992	schtasks.exe
1336	schtasks.exe
948	schtasks.exe
712	schtasks.exe
2052	schtasks.exe
1276	schtasks.exe
1236	schtasks.exe
2628	schtasks.exe
2816	schtasks.exe
1588	schtasks.exe
2016	schtasks.exe
1672	schtasks.exe
952	schtasks.exe
2636	schtasks.exe
2612	schtasks.exe
952	schtasks.exe
2768	schtasks.exe
2904	schtasks.exe
2076	schtasks.exe
1428	schtasks.exe
380	schtasks.exe
712	schtasks.exe
2624	schtasks.exe
868	schtasks.exe
3004	schtasks.exe
2384	schtasks.exe
1920	schtasks.exe
1928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2812	DllCommonsvc.exe
2812	DllCommonsvc.exe
2812	DllCommonsvc.exe
2812	DllCommonsvc.exe
2812	DllCommonsvc.exe
2812	DllCommonsvc.exe
2812	DllCommonsvc.exe
2216	powershell.exe
2032	powershell.exe
1804	powershell.exe
1788	powershell.exe
2456	powershell.exe
2036	powershell.exe
2200	powershell.exe
2920	powershell.exe
1796	powershell.exe
2852	powershell.exe
1784	powershell.exe
2980	powershell.exe
880	powershell.exe
2464	powershell.exe
1792	powershell.exe
2780	DllCommonsvc.exe
2776	powershell.exe
2600	powershell.exe
1316	powershell.exe
1928	powershell.exe
1264	powershell.exe
2280	powershell.exe
484	powershell.exe
2004	powershell.exe
1624	powershell.exe
1472	powershell.exe
680	DllCommonsvc.exe
1852	DllCommonsvc.exe
620	DllCommonsvc.exe
2116	DllCommonsvc.exe
1692	DllCommonsvc.exe
1852	DllCommonsvc.exe
1472	DllCommonsvc.exe
1828	DllCommonsvc.exe
2960	DllCommonsvc.exe
1668	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	DllCommonsvc.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	2780	DllCommonsvc.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	680	DllCommonsvc.exe
Token: SeDebugPrivilege	1852	DllCommonsvc.exe
Token: SeDebugPrivilege	620	DllCommonsvc.exe
Token: SeDebugPrivilege	2116	DllCommonsvc.exe
Token: SeDebugPrivilege	1692	DllCommonsvc.exe
Token: SeDebugPrivilege	1852	DllCommonsvc.exe
Token: SeDebugPrivilege	1472	DllCommonsvc.exe
Token: SeDebugPrivilege	1828	DllCommonsvc.exe
Token: SeDebugPrivilege	2960	DllCommonsvc.exe
Token: SeDebugPrivilege	1668	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe	30
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe	30
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe	30
PID 2668 wrote to memory of 2804	2668	JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe	30
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2804 wrote to memory of 2848	2804	WScript.exe	31
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2848 wrote to memory of 2812	2848	cmd.exe	33
PID 2812 wrote to memory of 2980	2812	DllCommonsvc.exe	77
PID 2812 wrote to memory of 2980	2812	DllCommonsvc.exe	77
PID 2812 wrote to memory of 2980	2812	DllCommonsvc.exe	77
PID 2812 wrote to memory of 2852	2812	DllCommonsvc.exe	78
PID 2812 wrote to memory of 2852	2812	DllCommonsvc.exe	78
PID 2812 wrote to memory of 2852	2812	DllCommonsvc.exe	78
PID 2812 wrote to memory of 1792	2812	DllCommonsvc.exe	79
PID 2812 wrote to memory of 1792	2812	DllCommonsvc.exe	79
PID 2812 wrote to memory of 1792	2812	DllCommonsvc.exe	79
PID 2812 wrote to memory of 2200	2812	DllCommonsvc.exe	80
PID 2812 wrote to memory of 2200	2812	DllCommonsvc.exe	80
PID 2812 wrote to memory of 2200	2812	DllCommonsvc.exe	80
PID 2812 wrote to memory of 880	2812	DllCommonsvc.exe	81
PID 2812 wrote to memory of 880	2812	DllCommonsvc.exe	81
PID 2812 wrote to memory of 880	2812	DllCommonsvc.exe	81
PID 2812 wrote to memory of 1788	2812	DllCommonsvc.exe	82
PID 2812 wrote to memory of 1788	2812	DllCommonsvc.exe	82
PID 2812 wrote to memory of 1788	2812	DllCommonsvc.exe	82
PID 2812 wrote to memory of 1804	2812	DllCommonsvc.exe	83
PID 2812 wrote to memory of 1804	2812	DllCommonsvc.exe	83
PID 2812 wrote to memory of 1804	2812	DllCommonsvc.exe	83
PID 2812 wrote to memory of 1796	2812	DllCommonsvc.exe	84
PID 2812 wrote to memory of 1796	2812	DllCommonsvc.exe	84
PID 2812 wrote to memory of 1796	2812	DllCommonsvc.exe	84
PID 2812 wrote to memory of 1784	2812	DllCommonsvc.exe	85
PID 2812 wrote to memory of 1784	2812	DllCommonsvc.exe	85
PID 2812 wrote to memory of 1784	2812	DllCommonsvc.exe	85
PID 2812 wrote to memory of 2456	2812	DllCommonsvc.exe	86
PID 2812 wrote to memory of 2456	2812	DllCommonsvc.exe	86
PID 2812 wrote to memory of 2456	2812	DllCommonsvc.exe	86
PID 2812 wrote to memory of 2464	2812	DllCommonsvc.exe	87
PID 2812 wrote to memory of 2464	2812	DllCommonsvc.exe	87
PID 2812 wrote to memory of 2464	2812	DllCommonsvc.exe	87
PID 2812 wrote to memory of 2920	2812	DllCommonsvc.exe	88
PID 2812 wrote to memory of 2920	2812	DllCommonsvc.exe	88
PID 2812 wrote to memory of 2920	2812	DllCommonsvc.exe	88
PID 2812 wrote to memory of 2032	2812	DllCommonsvc.exe	89
PID 2812 wrote to memory of 2032	2812	DllCommonsvc.exe	89
PID 2812 wrote to memory of 2032	2812	DllCommonsvc.exe	89
PID 2812 wrote to memory of 2036	2812	DllCommonsvc.exe	90
PID 2812 wrote to memory of 2036	2812	DllCommonsvc.exe	90
PID 2812 wrote to memory of 2036	2812	DllCommonsvc.exe	90
PID 2812 wrote to memory of 2216	2812	DllCommonsvc.exe	91
PID 2812 wrote to memory of 2216	2812	DllCommonsvc.exe	91
PID 2812 wrote to memory of 2216	2812	DllCommonsvc.exe	91
PID 2812 wrote to memory of 2324	2812	DllCommonsvc.exe	106
PID 2812 wrote to memory of 2324	2812	DllCommonsvc.exe	106
PID 2812 wrote to memory of 2324	2812	DllCommonsvc.exe	106
PID 2324 wrote to memory of 2160	2324	cmd.exe	109
PID 2324 wrote to memory of 2160	2324	cmd.exe	109
PID 2324 wrote to memory of 2160	2324	cmd.exe	109
PID 2324 wrote to memory of 2780	2324	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_471435831bbac2d514a83f98125a9a28a43113c7cded6fdab5a485f6d38dcdf3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Microsoft Shared\Stationery\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\g5fW8J5J4L.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2160
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\taskhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\106.0.5249.119\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kdioc4MGud.bat"
        7⤵
        
        PID:1084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1968
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat"
        9⤵
        
        PID:308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2788
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GX2kvMhQbI.bat"
        11⤵
        
        PID:2160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1288
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9kwbr7Wkdx.bat"
        13⤵
        
        PID:1744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1056
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat"
        15⤵
        
        PID:2308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:788
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDwMkfOC2e.bat"
        17⤵
        
        PID:1680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3032
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mv8e4zbUuN.bat"
        19⤵
        
        PID:2600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2228
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat"
        21⤵
        
        PID:1480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2948
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3EiKDvRnKw.bat"
        23⤵
        
        PID:2220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2784
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fELEOgu8eF.bat"
        25⤵
        
        PID:2140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1684
        
        C:\Program Files\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files\Windows Portable Devices\DllCommonsvc.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\system\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\system\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\system\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Music\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default\Music\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Microsoft Shared\Stationery\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\Stationery\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\Microsoft Shared\Stationery\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Favorites\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Favorites\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Windows\system\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\system\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\system\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SendTo\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\SendTo\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\csrss.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\886983d96e3d3e

Filesize
837B

MD5
8ad54b5ce78c4d77c0883639ecc19650

SHA1
3210b03489bf30a634d5e81855529958d162ce2a

SHA256
35897638d00ba22b5047b2ddf22ebfa64edb5f6aa00212ab647b44051c352ce1

SHA512
efb1f96e8fe997e81ce73ced13cc0f7d35d2cc0d96615fcd58039f3e8a56cc67989073635dadb7579753bb5471eb97a227e0c7a936f2e76bd8dd4954d5d0b04f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
761f1a20096d8a8cdb0b6c33b99736dc

SHA1
c67b9b38563b22b566f44749bfee01d5bd8b7d5e

SHA256
0e80ecaee7cb7edcbb2a5eeedaec7be95943971ebd1d886c0d22be460a389d9c

SHA512
2d0d839073c17f20db2026e815d073b2c21dd888ad0f7f742392cffbcbc0ac259fd16a450456b55cf9c7755053fb3f118a7cee21cf3fdde6e94b7b8f2dcabd17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b0f6a0cd9ad0dfe788b07c514cb73c2

SHA1
079e08a7556cdc58950ab614165174894aab7a31

SHA256
1cf067c0f0aa9aed9bda5654be643cf89ff26fcc6b18a5a47c4fc55579d2b424

SHA512
ab35d0212d74da480804bb9c2ddc906b148d01288ed92428c27d2f0933098485bba5ef452d2f0d351271599563ff2ec87c44f683c68ae5a0243a3faed79d1a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b2e5e5c095dd9c2b8d4ab39bd1405a4

SHA1
a28ca805cdd171c8a928cee539267bff3a498c12

SHA256
2104d7833c759aca72675b613ae28ec17c31e14cc3d6ada25da9ccc155fad6ce

SHA512
afb2ec5aeaad9c9418984c9568038b0069167237f75517ee3cc7f1be44fc2f45cb00af2db91b982eefa705429578bae9d9ba0abd2802719b9a6c9fedb4951201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3beb4ddc5ad17e011adf122cbde28d50

SHA1
c98e32fd4f1b8171fdcd2b623e86eec75d92f811

SHA256
f1c0b8ae53e34d753ebfb5f946f002c9b9ed309d9c1bf871a66530a8c936959b

SHA512
055a575ac48bf2c1084f376b1874558ddccb559056ebfe1d85c402ac346677fadfef69c0721a8b282130a6a2fa681202919bc91fc9dd4a7c784318cef0e4dc34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e683a07593c27ce4a88ffc7c247a9b10

SHA1
959fcd0bc35ed53a5fd494cc1c1c408cc2b42aff

SHA256
ba98ae946a25ea95398cb6ff69b7f4ba05d55ff56c3283527308bc12dcfd9473

SHA512
05d9c287f2619701e9a2f9c7011c07b3cf69a481478956f9a83b087714722e474f6d42657510784fd800fc9b1727ddf609b2bcd431246ae3ab0b3a4936449cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b6dbd557d75733fce167374cbc02514

SHA1
03d82da2d59eb1fd6b9e8def1fdec711d6ff89e3

SHA256
cfff698aed188e19604d90d73f017e561e791be53e9ad62e50aa64343cc9da00

SHA512
e5e1e1c6abd7fc79eab7079a1b10651646e18fb8fe421e8dc111cb6aec9b50474d87b567ad84ea951c89cb84acc48c5d7a514a6da70befcbd93f9ac5fb6513bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
827334612987f9a9b80170674d97a1a8

SHA1
5666ca706c5d60f1d431f53910f24f360b718bb3

SHA256
f13f2f7e97f4efa2c9e070c041937449ed6a71e9e134f4ea86a9fe0a39e6cccb

SHA512
04728217f4eae4f5f6d841bec4d9af109aa48679994d9bc75223f38e3964765f5a2f0f0c788f165df022e91d19b7f3c52a80ea6516acadfd85819ca6c0cfac21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
984f9ad76db7618a0623a8b16b1111f4

SHA1
dade293958dc9021428143f9680e024a98d0d4fa

SHA256
a2dc3fd79e19c44da370bdfb115f2f85b8b9fed82d2ecfa5074b9d3eb688fbba

SHA512
71d4fba9097ea4caee322d694e51c7fcd2f92c0b9f933de1f55880299b3cbd052617e7eb135a315a0a46ed773fd169a080261da07992309a7f54bba746ce539e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3EiKDvRnKw.bat

Filesize
223B

MD5
4da78fa28809aa54a2e52170c279becc

SHA1
d7d4ebe8355c58188fa4becb8c02f5f67cd1a52f

SHA256
097bc6a8e83894e5307f8c6e16f043d81b5606fd45540ccd9d0c1f3b90360f2c

SHA512
d070261f680664b1f26407f369fd5944ece3cdd649f807355e730c7a08f8f508c5e79712216254e1e51746317d9f406084489c9c631e76642c28e0c19a3f947b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9kwbr7Wkdx.bat

Filesize
223B

MD5
df37a5f3870a46975d70074451808af3

SHA1
b3f648eb8c43b32ce11e59422e5b74fa3ec9cfea

SHA256
707d22cd772e7bccc00dd10d2fe46123abb7e6565f3b55b89bb99e5597a372e9

SHA512
f8690b5e0050da553b25350792d84ce30f1bdb3a1e10ce044a42b2101885ebd8fb76b7931a7852d545dbe30ca6aa805360cf6b1b30ed557c1c2363a9176410a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6818.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GX2kvMhQbI.bat

Filesize
223B

MD5
38dc9be4268940a53483826c4ab821bf

SHA1
9c673da6ae5c6df08ba01743e9d60dacfcdd09f7

SHA256
05dc0e7e1acaae7b8da74cfde104754e98f2e9a6a6ccc1c1d7f67eb1b009b04a

SHA512
bf35406ceb44b9f8e504abae057e2abae92df64f9da2ca6f2febf574eb90afeee25a8e78205602cb3f21942aac424c9fae516263909e4486e3f867b0c705242c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kdioc4MGud.bat

Filesize
223B

MD5
909c685ec3d62dee208553fdc1243be6

SHA1
9331783bd877ec69705b5b2326e291e7ea2ba03f

SHA256
e917ea4bfffbef21c93e505d6448c46e4b8a20fc893becc75cf3d96b67465bf3

SHA512
167865c66523049c8aebdf8a4d1954ec47abc717d51314fe5b440482da878fc0783fb4f7d74c53c16b46d658e7a9c8af78edb2e166b016e7b367a91ec47ad4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mv8e4zbUuN.bat

Filesize
223B

MD5
7937557f3463e425881f98f005309e61

SHA1
b7d59a1bc114d35e508f6cbd6ddafeb849c030e0

SHA256
495e0cb48f875cc4b67efbc84a3fd047dea55de3225e76393682bfb246c0c15c

SHA512
733325ab91d4711c01f8fce8c991e54c414cf0ff98f1d58586d5dbfb10ac578e57f4f2354765519938913b3ff22da2542e444f588b3c1f91460392e2d845f35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat

Filesize
223B

MD5
fdc0361f679f4f51e0b735c6e227ef3d

SHA1
35f260b1b825baf245d82adcb4a2587791699ca9

SHA256
df8eda81776151ddcebbd43a11f945717674193087fbd169ac74a7eb187f2718

SHA512
e315f2b8f2b107b6fd39d2b97328747460573c61f05a25d55ca1c1e7d1c2fc5ee2fbc89f3da43960554b4e5120023128e016e6962f7f19d0452f26a6464fbec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat

Filesize
223B

MD5
5cc31f4421109871bb68f341e4cae4a8

SHA1
1055fea1c31c44772f8efeeb88a1fc21030a9884

SHA256
801ba25d2025d964006c4947db3c409d9b32aa799a32923a8439c6e1004039a8

SHA512
d5d33c9ed76637bd2951b34580b09499d07da98fa6ec7bc499f2c7f7bef04a5c429ad2dc36f6d47bf00ec5cea7c9efcea1730632d18538393a327d2f2cc0909b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar682A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\g5fW8J5J4L.bat

Filesize
199B

MD5
656d09ea16e729b0497fc8001bee11bf

SHA1
4a6dff36c55e19b91f896c1b15a67910f1e84c7d

SHA256
3b99ceb8f2abebbb7d97708fc27f05b5b4aa8970c86e78f6abb8681940da3c9b

SHA512
6854482418d5ed1482d32f6f736026b76f77ec13554a7226b1224e2a609eda3b83358b6f31a038b5bc888f58dcf52795895e3fd6f753881d1157a1d7fdacb829

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat

Filesize
223B

MD5
6b129662d22e3188153d5102a813e5cd

SHA1
a9008ed349cffdf4e7984343a741f946e7770d21

SHA256
39fdf3b102877abe445643c21f858f741378de5ba646779e486a552eb6ddebc6

SHA512
2d891f482e28f3b9d9fc9214ec6eafe976f598150fe5303339e407506b9106e44520b3af3ca6ee0f6d549dd78d9baf88ad3d088cab21ac3ac20ecee6c7d396cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDwMkfOC2e.bat

Filesize
223B

MD5
f85e3588a76887c7701b0d2b0173044c

SHA1
ac96adba98c6ee8313558346e12b170326720d22

SHA256
2cb2553c620153ad5535bdbae946aad3543c3ff8609b4dd3cdef6029512178de

SHA512
9c59be4dd3cb8eba013ede23952666485281d3dc7b7f868e846fed21dc8e7aac3dff98f7febd0212697adf6fa547088b2a2cf3c7cd10da9c0ad6f40a7d1715b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7a00576b927278271024f272aee97e79

SHA1
4cfc40a9e91154dc5bd7c008d66b2aa2d8f34f41

SHA256
691e4fba854032d61b01b2ff23a592879df4a0783789fc1cf001418f704c512b

SHA512
03ab5a8fa9ffe6fc10b12ce2bba6a562f00919ea4033f805d3bef4c711028eb5880cc9cf65cca9403d5d11e80736be2c072aec607fe445aaabbf975474df04ab

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/620-327-0x00000000001F0000-0x0000000000300000-memory.dmp

Filesize
1.1MB

Download
memory/680-208-0x0000000000140000-0x0000000000250000-memory.dmp

Filesize
1.1MB

Download
memory/1472-567-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1668-744-0x0000000000870000-0x0000000000980000-memory.dmp

Filesize
1.1MB

Download
memory/1692-447-0x0000000000130000-0x0000000000240000-memory.dmp

Filesize
1.1MB

Download
memory/1804-72-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1852-507-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/1852-267-0x0000000000D40000-0x0000000000E50000-memory.dmp

Filesize
1.1MB

Download
memory/2116-387-0x0000000000F90000-0x00000000010A0000-memory.dmp

Filesize
1.1MB

Download
memory/2216-76-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/2776-164-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2776-163-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2780-128-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download
memory/2812-17-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/2812-13-0x0000000000BD0000-0x0000000000CE0000-memory.dmp

Filesize
1.1MB

Download
memory/2812-14-0x0000000000A70000-0x0000000000A82000-memory.dmp

Filesize
72KB

Download
memory/2812-15-0x0000000000A90000-0x0000000000A9C000-memory.dmp

Filesize
48KB

Download
memory/2812-16-0x0000000000A80000-0x0000000000A8C000-memory.dmp

Filesize
48KB

Download
memory/2960-686-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download