dcrat | 62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe
Size

1.3MB
MD5

2c611b8c72eb7537552d309c75213882
SHA1

5343d3e70de35f1adee42b99c1a68140f6f8da10
SHA256

62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f
SHA512

aaf6e0e7836f6eab742bc125fc5de68c50753b115b3bc855e394503d66e890fc1bbb6799ef5f2eae663b07e8522c7d004421a7249d262d5937666e917dd0f056
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2564	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2564	schtasks.exe	35

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001650a-9.dat	dcrat
behavioral1/memory/2252-13-0x0000000000E80000-0x0000000000F90000-memory.dmp	dcrat
behavioral1/memory/1548-164-0x0000000000E90000-0x0000000000FA0000-memory.dmp	dcrat
behavioral1/memory/2948-282-0x0000000001250000-0x0000000001360000-memory.dmp	dcrat
behavioral1/memory/2164-520-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/1496-580-0x0000000000200000-0x0000000000310000-memory.dmp	dcrat
behavioral1/memory/2640-641-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat
behavioral1/memory/2544-701-0x0000000000A80000-0x0000000000B90000-memory.dmp	dcrat
behavioral1/memory/1944-761-0x00000000002C0000-0x00000000003D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2724	powershell.exe
1672	powershell.exe
1868	powershell.exe
356	powershell.exe
2552	powershell.exe
3020	powershell.exe
2792	powershell.exe
2628	powershell.exe
400	powershell.exe
2384	powershell.exe
3004	powershell.exe
2580	powershell.exe
2720	powershell.exe
2888	powershell.exe
2600	powershell.exe
1736	powershell.exe
2068	powershell.exe
2632	powershell.exe
2768	powershell.exe
2756	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2252	DllCommonsvc.exe
1548	services.exe
1016	services.exe
2948	services.exe
2156	services.exe
1760	services.exe
2204	services.exe
2164	services.exe
1496	services.exe
2640	services.exe
2544	services.exe
1944	services.exe

Loads dropped DLL 2 IoCs

pid	Process
3032	cmd.exe
3032	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
18	raw.githubusercontent.com
32	raw.githubusercontent.com
26	raw.githubusercontent.com
29	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
22	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\Accessories\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\es-ES\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\es-ES\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\dwm.exe	DllCommonsvc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ModemLogs\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\ModemLogs\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Windows\schemas\TSWorkSpace\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\security\smss.exe	DllCommonsvc.exe
File created	C:\Windows\security\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\ModemLogs\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Links\56085415360792	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Links\wininit.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2524	schtasks.exe
1676	schtasks.exe
2156	schtasks.exe
2612	schtasks.exe
2568	schtasks.exe
692	schtasks.exe
1760	schtasks.exe
3008	schtasks.exe
2208	schtasks.exe
1240	schtasks.exe
756	schtasks.exe
1440	schtasks.exe
1556	schtasks.exe
1928	schtasks.exe
1936	schtasks.exe
2332	schtasks.exe
2820	schtasks.exe
2084	schtasks.exe
1528	schtasks.exe
1512	schtasks.exe
2136	schtasks.exe
2368	schtasks.exe
1888	schtasks.exe
2928	schtasks.exe
2864	schtasks.exe
2528	schtasks.exe
1248	schtasks.exe
1056	schtasks.exe
2416	schtasks.exe
2072	schtasks.exe
1840	schtasks.exe
2272	schtasks.exe
1800	schtasks.exe
1916	schtasks.exe
1320	schtasks.exe
1268	schtasks.exe
2492	schtasks.exe
2736	schtasks.exe
2880	schtasks.exe
2620	schtasks.exe
2616	schtasks.exe
2280	schtasks.exe
2896	schtasks.exe
2844	schtasks.exe
1680	schtasks.exe
2056	schtasks.exe
1952	schtasks.exe
2180	schtasks.exe
2940	schtasks.exe
564	schtasks.exe
2372	schtasks.exe
2184	schtasks.exe
2128	schtasks.exe
2960	schtasks.exe
1480	schtasks.exe
408	schtasks.exe
1548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2252	DllCommonsvc.exe
2252	DllCommonsvc.exe
2252	DllCommonsvc.exe
2888	powershell.exe
2724	powershell.exe
356	powershell.exe
2552	powershell.exe
2580	powershell.exe
3020	powershell.exe
2628	powershell.exe
1868	powershell.exe
2632	powershell.exe
1736	powershell.exe
2384	powershell.exe
2768	powershell.exe
2600	powershell.exe
2792	powershell.exe
400	powershell.exe
2756	powershell.exe
3004	powershell.exe
1672	powershell.exe
2720	powershell.exe
2068	powershell.exe
1548	services.exe
1016	services.exe
2948	services.exe
2156	services.exe
1760	services.exe
2204	services.exe
2164	services.exe
1496	services.exe
2640	services.exe
2544	services.exe
1944	services.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	DllCommonsvc.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	356	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	1548	services.exe
Token: SeDebugPrivilege	1016	services.exe
Token: SeDebugPrivilege	2948	services.exe
Token: SeDebugPrivilege	2156	services.exe
Token: SeDebugPrivilege	1760	services.exe
Token: SeDebugPrivilege	2204	services.exe
Token: SeDebugPrivilege	2164	services.exe
Token: SeDebugPrivilege	1496	services.exe
Token: SeDebugPrivilege	2640	services.exe
Token: SeDebugPrivilege	2544	services.exe
Token: SeDebugPrivilege	1944	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2336	1668	JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe	31
PID 1668 wrote to memory of 2336	1668	JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe	31
PID 1668 wrote to memory of 2336	1668	JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe	31
PID 1668 wrote to memory of 2336	1668	JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe	31
PID 2336 wrote to memory of 3032	2336	WScript.exe	32
PID 2336 wrote to memory of 3032	2336	WScript.exe	32
PID 2336 wrote to memory of 3032	2336	WScript.exe	32
PID 2336 wrote to memory of 3032	2336	WScript.exe	32
PID 3032 wrote to memory of 2252	3032	cmd.exe	34
PID 3032 wrote to memory of 2252	3032	cmd.exe	34
PID 3032 wrote to memory of 2252	3032	cmd.exe	34
PID 3032 wrote to memory of 2252	3032	cmd.exe	34
PID 2252 wrote to memory of 2580	2252	DllCommonsvc.exe	93
PID 2252 wrote to memory of 2580	2252	DllCommonsvc.exe	93
PID 2252 wrote to memory of 2580	2252	DllCommonsvc.exe	93
PID 2252 wrote to memory of 2720	2252	DllCommonsvc.exe	94
PID 2252 wrote to memory of 2720	2252	DllCommonsvc.exe	94
PID 2252 wrote to memory of 2720	2252	DllCommonsvc.exe	94
PID 2252 wrote to memory of 2724	2252	DllCommonsvc.exe	95
PID 2252 wrote to memory of 2724	2252	DllCommonsvc.exe	95
PID 2252 wrote to memory of 2724	2252	DllCommonsvc.exe	95
PID 2252 wrote to memory of 2552	2252	DllCommonsvc.exe	97
PID 2252 wrote to memory of 2552	2252	DllCommonsvc.exe	97
PID 2252 wrote to memory of 2552	2252	DllCommonsvc.exe	97
PID 2252 wrote to memory of 3004	2252	DllCommonsvc.exe	99
PID 2252 wrote to memory of 3004	2252	DllCommonsvc.exe	99
PID 2252 wrote to memory of 3004	2252	DllCommonsvc.exe	99
PID 2252 wrote to memory of 3020	2252	DllCommonsvc.exe	102
PID 2252 wrote to memory of 3020	2252	DllCommonsvc.exe	102
PID 2252 wrote to memory of 3020	2252	DllCommonsvc.exe	102
PID 2252 wrote to memory of 2756	2252	DllCommonsvc.exe	103
PID 2252 wrote to memory of 2756	2252	DllCommonsvc.exe	103
PID 2252 wrote to memory of 2756	2252	DllCommonsvc.exe	103
PID 2252 wrote to memory of 2768	2252	DllCommonsvc.exe	105
PID 2252 wrote to memory of 2768	2252	DllCommonsvc.exe	105
PID 2252 wrote to memory of 2768	2252	DllCommonsvc.exe	105
PID 2252 wrote to memory of 2384	2252	DllCommonsvc.exe	107
PID 2252 wrote to memory of 2384	2252	DllCommonsvc.exe	107
PID 2252 wrote to memory of 2384	2252	DllCommonsvc.exe	107
PID 2252 wrote to memory of 356	2252	DllCommonsvc.exe	108
PID 2252 wrote to memory of 356	2252	DllCommonsvc.exe	108
PID 2252 wrote to memory of 356	2252	DllCommonsvc.exe	108
PID 2252 wrote to memory of 2632	2252	DllCommonsvc.exe	110
PID 2252 wrote to memory of 2632	2252	DllCommonsvc.exe	110
PID 2252 wrote to memory of 2632	2252	DllCommonsvc.exe	110
PID 2252 wrote to memory of 2068	2252	DllCommonsvc.exe	113
PID 2252 wrote to memory of 2068	2252	DllCommonsvc.exe	113
PID 2252 wrote to memory of 2068	2252	DllCommonsvc.exe	113
PID 2252 wrote to memory of 400	2252	DllCommonsvc.exe	114
PID 2252 wrote to memory of 400	2252	DllCommonsvc.exe	114
PID 2252 wrote to memory of 400	2252	DllCommonsvc.exe	114
PID 2252 wrote to memory of 2628	2252	DllCommonsvc.exe	115
PID 2252 wrote to memory of 2628	2252	DllCommonsvc.exe	115
PID 2252 wrote to memory of 2628	2252	DllCommonsvc.exe	115
PID 2252 wrote to memory of 1868	2252	DllCommonsvc.exe	116
PID 2252 wrote to memory of 1868	2252	DllCommonsvc.exe	116
PID 2252 wrote to memory of 1868	2252	DllCommonsvc.exe	116
PID 2252 wrote to memory of 1672	2252	DllCommonsvc.exe	117
PID 2252 wrote to memory of 1672	2252	DllCommonsvc.exe	117
PID 2252 wrote to memory of 1672	2252	DllCommonsvc.exe	117
PID 2252 wrote to memory of 2792	2252	DllCommonsvc.exe	118
PID 2252 wrote to memory of 2792	2252	DllCommonsvc.exe	118
PID 2252 wrote to memory of 2792	2252	DllCommonsvc.exe	118
PID 2252 wrote to memory of 1736	2252	DllCommonsvc.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62580ecc73f4d611a7e3ca768159c048e5ebbaf3d85dba81fd7f845bf230f35f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft Help\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Links\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\es-ES\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\plugins\services_discovery\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AaMk9KZjbK.bat"
        5⤵
        
        PID:1916
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2484
      - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RBIFf9IaIr.bat"
        7⤵
        
        PID:2848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2888
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat"
        9⤵
        
        PID:1996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2916
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat"
        11⤵
        
        PID:752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2372
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat"
        13⤵
        
        PID:1528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1912
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat"
        15⤵
        
        PID:2400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1616
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQKAuQiBIV.bat"
        17⤵
        
        PID:2580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1736
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        19⤵
        
        PID:2172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2156
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat"
        21⤵
        
        PID:756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2888
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        23⤵
        
        PID:1868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2952
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat"
        25⤵
        
        PID:2140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1636
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ModemLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft Help\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft Help\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\security\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\security\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\security\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\ServiceProfiles\NetworkService\Links\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Links\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\NetworkService\Links\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\es-ES\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\plugins\services_discovery\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\services_discovery\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\plugins\services_discovery\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ddb5e94495bd985d5d9bb403085e0da

SHA1
b5527185495bc2fdc532f32e58c9f43d5e284e21

SHA256
f4d6ee2d6ce3e94c8ec3152feb0b2b9d325fcfda1dbae977263f53cdb817e831

SHA512
8af30da05e45c1b877b63ea806c6774de765d619e2de2f246c7afb9a2523a77bcca7ea233085bd5bd2ed52d6b3c3cee33604074533e7c5002493ef9ee6bd6b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21a3bab7f5fd78b9c3c3c6d20abdb6a9

SHA1
3601f66b067db3909a4a7562165132e83c881789

SHA256
a4b03dc824f6b64c5f77e279cb1d1358a7312fd100f4c0c4730dce912cf40e71

SHA512
c4504858d67ee5110993ffc134d4230e5faa44c0c526b9092dede6374b2af30fbedff75e5a5e92a9b113f264865fadf60482657e4b443ea599000b28763a980e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78cff0345bf008ab1b494faa426e002f

SHA1
746b9f26c8a1eee8a652816601a0e792a5284ece

SHA256
29c3ef5ec32b58a9bb35f8f707689ae244c71d271b33e692210649229d893888

SHA512
b6f5d2157418e363d6ed7eeb8857021a41fc189d37d29b64413624a502725f290d6a26e43f285172aa939d28a78365b902a19aa6c6d60c367f7aafbd2f607b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95fe0000b528e4b70434a549782641f6

SHA1
4db05a9d1c4e76d249b4d1ac03e495622eb902f9

SHA256
6bab800b81616b3498fd7a9e3bae07f915174b6815bc3720c647aee2943bad75

SHA512
9ddf81242d450a0f3c060c4a79964f93d8b2bd0ae43a5186ee549122e69074a53bbd6b6665c9b8d2bf53cb46751cdad8dfa8824b29f5025f9dd82b73e69b0b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afa03aa8899be167c6463e4cf4a142b1

SHA1
d47f65d2526ca0fb183197006a5c278bdd76a0b9

SHA256
54fd0fc523a67924394bc180cfd75b46f09b1d99f8e734622a18a197c027023d

SHA512
f6ae26b9c065ed1407328f1b5619d7e0ac5bc76e897b666ced08e21937f5f56a1fdd3eae6c3d85178f46f374567fad60450fb28fd279328991b000fb2db45408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8481116b15dce4ce5c4754ec272c697f

SHA1
b402ed813f9c9877ebd73ceb30155355e5fcf9ba

SHA256
6264838e59dab886ec7c44eda8ec86f0c3672339d2ddc26d94a2a2b5c3590dfe

SHA512
e3f8f0de2f646218c80a72227531e040e374e7594b8c8806deff2d95b6d45676bbc23131394c67cd9b40dab17efcbf99814e5caf48be1f16113e0d2902575214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efad84f07dd8baaa1eb5f625eed43a75

SHA1
21e3e9576835085f33b76722a175d77bdf4a8f82

SHA256
495bf81ec697f40c2161b51acab32803c54d89acfbf13b3418909992d27c0a45

SHA512
cb60483bd3a38043ec5397d2c0708a51b099e7cfc61818f31199e4187b64772e0f02ed7a4a422d7caf835523d3352a078feebfc7883abb74fcd64cc39efe9953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fdfcf5f24457121c706983404161133

SHA1
e3f5ccf5304872c7b560fdd9ed02c63e365c4651

SHA256
addc77f446ebd816f9532c1bb1504972a716aece733fc1b3f5a8ad96349508cc

SHA512
be7565ae61c01f100b848c60ffe87d2d6c75d5d92e53ef82f5fafe32b93d2e08a0b13fd0716066bb1fabbf67b89d3bcaad70af3e2712ecb557bd2ca02a76c618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbbdb3e40caed5dab885cdd48c7e7d68

SHA1
03e53f04ccb1e7808ecd9d4ba147dd671e9994cc

SHA256
60aaa127ed9fd0b41a436fe27282b59b9a48a289d879f3310b5ad4ef0af5efb1

SHA512
ad6d740dc23e1489fc315d84b3e7e15a3b414da621cc4e8f8b14df0fec96402ca451e8fab70556d387561dbbfd18cc1522914c8567756cfe50cf752e0db9bf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat

Filesize
240B

MD5
d86e51ee3b478da7cb12454da0e368ae

SHA1
82ea2b0f8cb6b59b220c5e1ecaf42e976862ad9d

SHA256
0c4c872ec8b3bbf96879b03b3091c99dbf234324cb4cb666104bb21138289828

SHA512
672cf717f63f5843eac5b25cf168aea02b6ea7a260d3b285615ae94d57a15e2ad8810fcd315063812f91398e3f1c7b27f12efd8a564d13e2ad7a0a0c841bac98

Download Submit
C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat

Filesize
240B

MD5
bc6b5ac78d530c6bb71d17a49e873c33

SHA1
a4e3d381129c500b124570f6b48ca14a30df9905

SHA256
8ee3cdd5cc30c389dd7250724d0a67622aa2365b5effb96022d1b821a581facd

SHA512
bda57396c4076ab9a24d7245721d266021a78568eee9f2fd947f941a98f81d2866d309239b5f73f6eacbfef952220dcda1325945624507ffcc3ed8bfc2707b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AaMk9KZjbK.bat

Filesize
240B

MD5
b8f4e08295e30d768d47ab65f26c468f

SHA1
ee0be6033768c1b0b36c7017b45dd1a0dc88b4fd

SHA256
97aeaf67051399e70541fea2d2994cd5e1647f2811b14a7f6a1422b0569baba2

SHA512
5bb83a01bddd228c380789e18d28d02d725303879d2edd8e651f86140983ba0d8e88a6119adf87608613547a1d8f5b460c3b77f3261217e79871832c47d84898

Download Submit
C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat

Filesize
240B

MD5
495f39ad90cf7220835343d90370a5ac

SHA1
bf1286330dadfaaccfdb1793d5c3a5aa6fd75efc

SHA256
2e836a938bd62e1cb2a3170207ed3561516916c283ef0195499efd0baa79495e

SHA512
2207eb75ca838f3a41b807a66af56fae0fa2e5edcbfd849c566755e2323de0cb90eaae66bd8c432c60beeabd2b45d2d7fa823ad2a63f03f86155012fd139ec05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E62.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat

Filesize
240B

MD5
926eacff9b1f8fb93e4cb8532c76c8ee

SHA1
67e5713811b78c6dce60d0d27cce2d01cee3b478

SHA256
b9e7e1e4da9bd0d684910616315c75420abe1713fc23ac4bca651994b1b10eb2

SHA512
a0a98d0ea23e27021327fdbf33cf969b74ee907828f186c612635332938ac19b2d4725456bf1eeb8f4d8fd995098f382489c018f098acfb153f9cdb59674dfe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat

Filesize
240B

MD5
80e817e55c50c823d411a67de27f3efe

SHA1
c6aa20729f31fa12341d7781052cfd45a7314f07

SHA256
588b39cb9c053251b3c5293234aa50a74fda83fe4acb8b5165674739b30e66ca

SHA512
0f3a5b7038a5cd9b03ddd382d1e61917fe56a4a84fdba0a948bdcc6878e1670d2261c404d9227c4cbace5f211695cf68fca46c1f157628f8850414503acabd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RBIFf9IaIr.bat

Filesize
240B

MD5
eed2fac8a8e3b96681b877e0e82392ee

SHA1
5655612fafc4bfd26b3144df73a722e45e07a9e1

SHA256
244da8ce3da342d4d44f263da27bbe0d8cb4dd57bf9ca719471639407938443a

SHA512
e6e057dda5b0460cee2dcc8d05b6dd5aad7bef9b99b2b7da38d3eff33c026c91260c39ba1c131b4b6ef73f6f8ac587d7d9b415bdc976f1a2774d38b9e786c4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E85.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
240B

MD5
9ce5b2613899942885be7b091124896c

SHA1
9b0f25d66e9d50bb34e3b8b7cffde74754fe9472

SHA256
633f8beda58b1efefd898230962f11e1c1cd39cbdfe948f2e85a1bf2cb35c23d

SHA512
31943c5b8c185b061f587f871ffcd03ba879929eb0713e32164218e366933e1ab789924e51dc320a5a9c89b322b732a13233c11bbf6b296c996c58d8e4f8e6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat

Filesize
240B

MD5
862d12211c96e81f70c641f22aa9db6d

SHA1
25e66eece14ccef976acddfa09b48510016d095f

SHA256
d5317162eaceb5920b1436a366c3e4030acb4af64beb9330dc9c17354b679cac

SHA512
4469531d9fd4b14ac94f4d1fbc4ac464faaf4baa17f5c73bc6d305eadaeaeac61cc0e841eb8688de9881a63dfe5163652f9dcc193bb34511f58e8c95329c5441

Download Submit
C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat

Filesize
240B

MD5
a2a2feaffe0512e36f033f7db5b12197

SHA1
693aabbcb9edfdd0cb3b3a235133d2ff730f0c4d

SHA256
9f7b3188ff469eb09f91ea2a6accd111d21c04177d09d1037a54f609511ac8b0

SHA512
7cae816f61e2f8398e5887c2be68c5ee74da42293b2f8fc0a804ae7ca328daa9c3c5895f4e2dd84cb647b4871f4ecf637a1e5f7f562f2c05942e3ff6cb00f624

Download Submit
C:\Users\Admin\AppData\Local\Temp\yQKAuQiBIV.bat

Filesize
240B

MD5
983bd61dc6309c2b9f618061d3b2ff44

SHA1
cb3d0e9a08e594d8b2d42542b8cc1a37ee92e531

SHA256
0c0d79109836c02b50508d98660d5745afb1fa38728f9a6407261e159778cd7c

SHA512
3be4c0c1d211b497e1a3a9fce0d8e5de53c45964a9fae9e1b0a75a3733421974b6cfc1cd3dad43cfb55caff8b1d9a876bfcd3001d6bce59ec2bf42e9681ad2b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2a5decd8e147626331101373f7499c52

SHA1
fc1007ef0534de24087762cf07648ca0c2a39c86

SHA256
66cdd118aef0d6f9c08ab60726d6d6b9555f95e5dfc814f40775ae1e2085fcac

SHA512
b406b0fc84a77c7c2d40e670895809be3400feb02517c6e120406f82ca17ffc9b5299cc9da9561f689526f781bd78426f3ffed610c0be28d3297427de4e259a6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1496-580-0x0000000000200000-0x0000000000310000-memory.dmp

Filesize
1.1MB

Download
memory/1496-581-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1548-164-0x0000000000E90000-0x0000000000FA0000-memory.dmp

Filesize
1.1MB

Download
memory/1944-761-0x00000000002C0000-0x00000000003D0000-memory.dmp

Filesize
1.1MB

Download
memory/2164-520-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2252-14-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2252-16-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/2252-15-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2252-17-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Filesize
48KB

Download
memory/2252-13-0x0000000000E80000-0x0000000000F90000-memory.dmp

Filesize
1.1MB

Download
memory/2544-701-0x0000000000A80000-0x0000000000B90000-memory.dmp

Filesize
1.1MB

Download
memory/2640-641-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2888-86-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2888-85-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2948-283-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2948-282-0x0000000001250000-0x0000000001360000-memory.dmp

Filesize
1.1MB

Download