dcrat | 093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe
Size

1.3MB
MD5

cf0ad2d3ec0bbc4497b85dbb2f0ddeee
SHA1

0b344c08f9675c6ee675a0f493b3b21863de0431
SHA256

093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63
SHA512

09ecc53ee18236dc934e613480f60bf0ef25504a3d33dc64e765121be95b5592a480b3848e116c380e4b5ff11d31e5924d35d4548b32ad6c46352661a167cb20
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2964	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2964	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000019496-9.dat	dcrat
behavioral1/memory/2704-13-0x0000000000B50000-0x0000000000C60000-memory.dmp	dcrat
behavioral1/memory/2124-62-0x0000000000890000-0x00000000009A0000-memory.dmp	dcrat
behavioral1/memory/1336-222-0x00000000003D0000-0x00000000004E0000-memory.dmp	dcrat
behavioral1/memory/1476-282-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/2144-343-0x0000000000DC0000-0x0000000000ED0000-memory.dmp	dcrat
behavioral1/memory/1952-403-0x0000000001380000-0x0000000001490000-memory.dmp	dcrat
behavioral1/memory/2104-642-0x00000000000B0000-0x00000000001C0000-memory.dmp	dcrat
behavioral1/memory/2040-702-0x0000000000920000-0x0000000000A30000-memory.dmp	dcrat
behavioral1/memory/1028-762-0x0000000000FE0000-0x00000000010F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2600	powershell.exe
2940	powershell.exe
1892	powershell.exe
2580	powershell.exe
2552	powershell.exe
536	powershell.exe
1180	powershell.exe
2612	powershell.exe
2848	powershell.exe
2804	powershell.exe
2924	powershell.exe
1404	powershell.exe
1736	powershell.exe
2716	powershell.exe
2852	powershell.exe
2284	powershell.exe
2608	powershell.exe
2916	powershell.exe
1996	powershell.exe
2724	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2704	DllCommonsvc.exe
2124	csrss.exe
1336	csrss.exe
1476	csrss.exe
2144	csrss.exe
1952	csrss.exe
1208	csrss.exe
3036	csrss.exe
2016	csrss.exe
2104	csrss.exe
2040	csrss.exe
1028	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
2652	cmd.exe
2652	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
15	raw.githubusercontent.com
26	raw.githubusercontent.com
39	raw.githubusercontent.com
36	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com
23	raw.githubusercontent.com
29	raw.githubusercontent.com
32	raw.githubusercontent.com

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\088424020bedd6	DllCommonsvc.exe
File opened for modification	C:\Program Files\Common Files\Services\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\fr-FR\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Services\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Services\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\winlogon.exe	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\services.exe	DllCommonsvc.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\winsxs\explorer.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
2052	schtasks.exe
2912	schtasks.exe
2660	schtasks.exe
580	schtasks.exe
2300	schtasks.exe
1204	schtasks.exe
1340	schtasks.exe
2932	schtasks.exe
3024	schtasks.exe
2240	schtasks.exe
2904	schtasks.exe
1756	schtasks.exe
684	schtasks.exe
2236	schtasks.exe
1352	schtasks.exe
1400	schtasks.exe
2988	schtasks.exe
3004	schtasks.exe
1784	schtasks.exe
2020	schtasks.exe
2888	schtasks.exe
2088	schtasks.exe
1800	schtasks.exe
2692	schtasks.exe
1136	schtasks.exe
2572	schtasks.exe
1056	schtasks.exe
2764	schtasks.exe
1192	schtasks.exe
3028	schtasks.exe
1376	schtasks.exe
2620	schtasks.exe
1648	schtasks.exe
604	schtasks.exe
2856	schtasks.exe
1888	schtasks.exe
2860	schtasks.exe
2604	schtasks.exe
700	schtasks.exe
996	schtasks.exe
2836	schtasks.exe
1636	schtasks.exe
2520	schtasks.exe
1876	schtasks.exe
2192	schtasks.exe
1688	schtasks.exe
1220	schtasks.exe
1592	schtasks.exe
2408	schtasks.exe
1836	schtasks.exe
1680	schtasks.exe
2616	schtasks.exe
2104	schtasks.exe
1208	schtasks.exe
1652	schtasks.exe
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2704	DllCommonsvc.exe
2704	DllCommonsvc.exe
2704	DllCommonsvc.exe
2704	DllCommonsvc.exe
2704	DllCommonsvc.exe
2704	DllCommonsvc.exe
2704	DllCommonsvc.exe
2804	powershell.exe
2724	powershell.exe
2852	powershell.exe
2600	powershell.exe
2916	powershell.exe
2124	csrss.exe
2552	powershell.exe
2284	powershell.exe
1404	powershell.exe
2924	powershell.exe
536	powershell.exe
1996	powershell.exe
1180	powershell.exe
2940	powershell.exe
2716	powershell.exe
1892	powershell.exe
2580	powershell.exe
2848	powershell.exe
2608	powershell.exe
1736	powershell.exe
2612	powershell.exe
1336	csrss.exe
1476	csrss.exe
2144	csrss.exe
1952	csrss.exe
1208	csrss.exe
3036	csrss.exe
2016	csrss.exe
2104	csrss.exe
2040	csrss.exe
1028	csrss.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	DllCommonsvc.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2124	csrss.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1336	csrss.exe
Token: SeDebugPrivilege	1476	csrss.exe
Token: SeDebugPrivilege	2144	csrss.exe
Token: SeDebugPrivilege	1952	csrss.exe
Token: SeDebugPrivilege	1208	csrss.exe
Token: SeDebugPrivilege	3036	csrss.exe
Token: SeDebugPrivilege	2016	csrss.exe
Token: SeDebugPrivilege	2104	csrss.exe
Token: SeDebugPrivilege	2040	csrss.exe
Token: SeDebugPrivilege	1028	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 604	2096	JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe	31
PID 2096 wrote to memory of 604	2096	JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe	31
PID 2096 wrote to memory of 604	2096	JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe	31
PID 2096 wrote to memory of 604	2096	JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe	31
PID 604 wrote to memory of 2652	604	WScript.exe	32
PID 604 wrote to memory of 2652	604	WScript.exe	32
PID 604 wrote to memory of 2652	604	WScript.exe	32
PID 604 wrote to memory of 2652	604	WScript.exe	32
PID 2652 wrote to memory of 2704	2652	cmd.exe	34
PID 2652 wrote to memory of 2704	2652	cmd.exe	34
PID 2652 wrote to memory of 2704	2652	cmd.exe	34
PID 2652 wrote to memory of 2704	2652	cmd.exe	34
PID 2704 wrote to memory of 2552	2704	DllCommonsvc.exe	93
PID 2704 wrote to memory of 2552	2704	DllCommonsvc.exe	93
PID 2704 wrote to memory of 2552	2704	DllCommonsvc.exe	93
PID 2704 wrote to memory of 2600	2704	DllCommonsvc.exe	94
PID 2704 wrote to memory of 2600	2704	DllCommonsvc.exe	94
PID 2704 wrote to memory of 2600	2704	DllCommonsvc.exe	94
PID 2704 wrote to memory of 2716	2704	DllCommonsvc.exe	97
PID 2704 wrote to memory of 2716	2704	DllCommonsvc.exe	97
PID 2704 wrote to memory of 2716	2704	DllCommonsvc.exe	97
PID 2704 wrote to memory of 1736	2704	DllCommonsvc.exe	98
PID 2704 wrote to memory of 1736	2704	DllCommonsvc.exe	98
PID 2704 wrote to memory of 1736	2704	DllCommonsvc.exe	98
PID 2704 wrote to memory of 2724	2704	DllCommonsvc.exe	99
PID 2704 wrote to memory of 2724	2704	DllCommonsvc.exe	99
PID 2704 wrote to memory of 2724	2704	DllCommonsvc.exe	99
PID 2704 wrote to memory of 2284	2704	DllCommonsvc.exe	100
PID 2704 wrote to memory of 2284	2704	DllCommonsvc.exe	100
PID 2704 wrote to memory of 2284	2704	DllCommonsvc.exe	100
PID 2704 wrote to memory of 1404	2704	DllCommonsvc.exe	101
PID 2704 wrote to memory of 1404	2704	DllCommonsvc.exe	101
PID 2704 wrote to memory of 1404	2704	DllCommonsvc.exe	101
PID 2704 wrote to memory of 2940	2704	DllCommonsvc.exe	102
PID 2704 wrote to memory of 2940	2704	DllCommonsvc.exe	102
PID 2704 wrote to memory of 2940	2704	DllCommonsvc.exe	102
PID 2704 wrote to memory of 2924	2704	DllCommonsvc.exe	103
PID 2704 wrote to memory of 2924	2704	DllCommonsvc.exe	103
PID 2704 wrote to memory of 2924	2704	DllCommonsvc.exe	103
PID 2704 wrote to memory of 2580	2704	DllCommonsvc.exe	104
PID 2704 wrote to memory of 2580	2704	DllCommonsvc.exe	104
PID 2704 wrote to memory of 2580	2704	DllCommonsvc.exe	104
PID 2704 wrote to memory of 536	2704	DllCommonsvc.exe	105
PID 2704 wrote to memory of 536	2704	DllCommonsvc.exe	105
PID 2704 wrote to memory of 536	2704	DllCommonsvc.exe	105
PID 2704 wrote to memory of 1892	2704	DllCommonsvc.exe	106
PID 2704 wrote to memory of 1892	2704	DllCommonsvc.exe	106
PID 2704 wrote to memory of 1892	2704	DllCommonsvc.exe	106
PID 2704 wrote to memory of 2804	2704	DllCommonsvc.exe	107
PID 2704 wrote to memory of 2804	2704	DllCommonsvc.exe	107
PID 2704 wrote to memory of 2804	2704	DllCommonsvc.exe	107
PID 2704 wrote to memory of 2848	2704	DllCommonsvc.exe	108
PID 2704 wrote to memory of 2848	2704	DllCommonsvc.exe	108
PID 2704 wrote to memory of 2848	2704	DllCommonsvc.exe	108
PID 2704 wrote to memory of 2852	2704	DllCommonsvc.exe	109
PID 2704 wrote to memory of 2852	2704	DllCommonsvc.exe	109
PID 2704 wrote to memory of 2852	2704	DllCommonsvc.exe	109
PID 2704 wrote to memory of 2612	2704	DllCommonsvc.exe	110
PID 2704 wrote to memory of 2612	2704	DllCommonsvc.exe	110
PID 2704 wrote to memory of 2612	2704	DllCommonsvc.exe	110
PID 2704 wrote to memory of 1996	2704	DllCommonsvc.exe	111
PID 2704 wrote to memory of 1996	2704	DllCommonsvc.exe	111
PID 2704 wrote to memory of 1996	2704	DllCommonsvc.exe	111
PID 2704 wrote to memory of 2916	2704	DllCommonsvc.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_093a393488a6f0355551284128a899e5bd76be3ab86a8861f5dfb906195c2d63.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Services\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\assembly\GAC_64\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Videos\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\FreeCell\it-IT\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Music\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat"
        6⤵
        
        PID:2368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:580
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat"
        8⤵
        
        PID:1080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1504
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat"
        10⤵
        
        PID:2604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:860
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat"
        12⤵
        
        PID:1600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:696
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPH1A2PBmS.bat"
        14⤵
        
        PID:2448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2916
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"
        16⤵
        
        PID:1476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:320
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat"
        18⤵
        
        PID:2380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:952
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEoBbgPmrR.bat"
        20⤵
        
        PID:2468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2844
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat"
        22⤵
        
        PID:1312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:556
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat"
        24⤵
        
        PID:920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2072
        
        C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe
        
        "C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NHYDEKme3A.bat"
        26⤵
        
        PID:2800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\Services\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\Services\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Videos\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Videos\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Videos\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Games\FreeCell\it-IT\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\FreeCell\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Games\FreeCell\it-IT\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\uninstall\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\Office14\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Pictures\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Pictures\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Pictures\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
597948a5a0ccb9d3e81a814b2dce3237

SHA1
ac8b51906000e23b62e57b739003bb91e8ca4efc

SHA256
550f781ccc3ece5fa3c2c5173db465d7eda53a4aea95477800ca46c5b76a8cc9

SHA512
b582cd474d592bbf9bb24f64a06890447ee8573e79383450c730ad15e7a68de1704ba81dd23ec0f2c35a7acdc5a1c51702e107f88081e2c4d6c5d9ecbd74b7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d6318d96e96c6c849238517298f9a44

SHA1
3ef39fd99e268fe298e2f909cb630fd4076f9016

SHA256
8cefd789dfa0a137a2fe0305f5ba94d5dbbdc7484940f26f82a32e43ca02c97e

SHA512
c671d99f2357f88b100cdfed16758484587c3ab96f1ec4b70d0d24eb496207c9b5b62690732337ba352911f909fc6dbd1cb94e6c2260101d161b013cfd46cd2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6023a01cda44eb3e57247a88dc2f9cfc

SHA1
fdf36b399d9b047d4ae704bac283a2fadeecbfbe

SHA256
eb947e265512cc6160a27bf98fc3eb349a5647186a856f070792160ab3771257

SHA512
81dea300069635e05b8ef0bb8465e80147f24c6c2f07f85b063b4493110ca091f8377ffd4bf60275dc7fd30cd65b515e34eb036f45a84bda7b83dbfdcb260591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f928ce42a9869664e532abfb63694710

SHA1
79ed3655ee6543abedc83da0a70989bb87e2de90

SHA256
8c7278265a5e3b5ac6b1caa2356d9540316cd5cdf06fd9032fc1867c31e69bda

SHA512
ab08db71ca2edcd1d429fa13262156cc47899cb514015fe97283c7d3b781d41294086a33eec76a6590362ab82e7d33f881cab944ca0203f1f444999de7c8a799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58e62f7fab254ef4416833065adc62eb

SHA1
8d9de35b649db202239ec6dbeb01e9b6993764f1

SHA256
eac8290572ae16519a206e5d7e1deff1d157658be402e98328eb84c2c66f53a2

SHA512
a1ba39a5c5333fbf019c1bc4fb0f1af47696e278df5e2710400aad43f188d988c35b8cdf26894e01f241bc0a3a832af936d96e24d70a43e9ac3643af63dc4611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c3fa0cb17aed4cf176e47fca4798b7d

SHA1
b2a21237b711bb4ae8c31e6c344acc94c28d7180

SHA256
9140f9e75fe1c443896b34bb34e2ce207595537edb8e996ae8144895917648ba

SHA512
76e60b2d1d2716f2b84cfbd52f568ec036204d79aed4b93887ffca6cd5f4a8c623b54e412cc46e8873bb3aaf1de025bd473ddb3eb691effc58b05701bc33a014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a87b52cb3b53a26e36bbf6ade7542530

SHA1
b66ea3c1b0004927884bce781951331228c98278

SHA256
6ba799229e76224d1ac3d8de00b80531af858d67d246dd5de4269ceffb1c1a17

SHA512
2e5774b531f718a6b7738f18a5c1072037dac76648c5801e325bff3a7e7bddfbb5f73810686e8973752db0d34670053e3055fbb385693b8146980d89843cbeda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ba7d3bb3e663e186c55692b5c625477

SHA1
e0e419ba8d7a219f5ff4125622e76e7edf31c3e8

SHA256
3c87ad23781346bcd404b5a3ea80f9feda470cafcec43c55841c07333fdf3fd2

SHA512
324fb4495238e28a16fe8b0472ac4948857c9d977ff15e368b776a2400f3bd844db562b9f3e4b7052614eef129d3e6fe396a803ac9eb4061142935c4a4136876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbb46dbcefa75e86aa31bf5c6411ee67

SHA1
c5cb817c2f3ec3af19ca564574a2ccea1887192f

SHA256
4f893a82fb9b38955dc862fbb2b6b8b05a399e975c054a348166dff04ab6d626

SHA512
cc7d4b6f45dd0d604626044c77542a13231a3a245e7cae5ce00bc05e17c2cfcaf3ea7f76bce1ffbd7899fb4cc0d94e7f80cbdcb07ac0b3b00a53373f86eab073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d3fcf8cc0edf2e6d456976f6b6a4b02

SHA1
4aa6640a671f06d817ce4965e2e46e3df52d500a

SHA256
f138030915d995e6d27f2452c2bc873303b4c31c9b03c6a977428742d7d13ee7

SHA512
dbaf42ce65bb5fcd3e1667a36cfb1ec51a0e771946a012615e590aadee5c1fe90428f743cdd28ddc7e02fbaab8d6cf2a92a08d9209ea07c6070369cda5892728

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat

Filesize
225B

MD5
2cd9199099e252460659ed8a772b5d6c

SHA1
02b4c8253515931cd29fc1ca6f80967753fd59cf

SHA256
338cf4042333a35abb916fa611b85d48859f426135ab5efaf5ba8dc295ca2071

SHA512
98e7e31b49609c5357721b9df0d150b830ff1351f8e51a191db7886f38be60d895d60ba25f286eb064129a8a375b067bb6098a3282b5cb01564bab156b8c5bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2mwtwHUJyt.bat

Filesize
225B

MD5
d574069bcd538a9181711fc37207eff0

SHA1
9e5479cf18914bd7829b218eb801e183c5495f4f

SHA256
84a5e9c1cd34f28ee1de7bf54e7d246ce1c5d9c2529c99d3ea6c77b773c5c18b

SHA512
2f709355f8967b1177de92aabd303092cf4c6836636d8505e4c5670261113000ab22aa18511d6e97a27da145aeb5593a5219758e094321d4c11535d6c592c76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB68.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat

Filesize
225B

MD5
192fda80a67675ebb266af2d90fc11e5

SHA1
9d96fbad897d42a5da71fbbf9fca077520b8ccf2

SHA256
2d4de45d80ff842ad24da0e0d747f9147a4a4109c5371de20cbdca2a68c2aaca

SHA512
e55fec673cd438ceb157bef82e8f03a007b94d2ba08548522cfa6dba97a39f91dd39bb93ae86bf2ff5069477ca781aa17d11a08dd5dabe568996b3255bd6200f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat

Filesize
225B

MD5
878a9e69a6cb98c97e71c7ee600382b4

SHA1
fbbc72a1bd0b538e1836d1d7f9a54567b69d76fe

SHA256
d3733e4e52d4ccd671f2c1823a87a94f5a8edd08c3897c8f89f890de73fa342e

SHA512
b9709d8a7182c1be9f0df362ff3863a6a1c223f23fe7231ee73f20e0e7adcad7903be5750315838cacc664a6a335e69f520e03254c89fc453173a29a70b04c5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat

Filesize
225B

MD5
0317c11784b8a485c5625769055da1e9

SHA1
e515f338305136564af11bde422a7a0cea725f79

SHA256
b84da7a20e5b83fe0e6cd5cdf55c7d3322f8698fde6ba3839968c6d279e58418

SHA512
d59db834d97ad0ad21c29fc5a2f90d5135acbbe560a094ddd6aa4e03aa49d85d7ced93bc14124e01a65ce845ab2ecaf57194ea2fe02893d2cd9b5971232f9a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\NHYDEKme3A.bat

Filesize
225B

MD5
ff0ffbe30c90e24c0422ac9265ddfecf

SHA1
69fff01c5cf3586a984060efdeeec9516f7f9f26

SHA256
dac6113d60999fd9fbdc8d6d64ace337541fbd9515d3b94f8e07dac2c2a21476

SHA512
4253f59ab95f4b2ca9dcdc147649e08944c01eb636002e8b819a6f9dd8aa1d896aeced31a3e1b3fea96e58d5fd5a62c174320231e0d4426e071cee3046d55a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat

Filesize
225B

MD5
40d5f47e283affb0d2b9654171ee56c2

SHA1
f62f7c8269969ba42a57cdd00ee37a6055283734

SHA256
aee35e59664db7d4ee27a8a9d5f1281fd5aa82733a742e268c3ef7d2caaab164

SHA512
4569ce6d973f92dc9504dc9a0cf9089d9e7f871796e8c48e0790e8d66149b14fc18f487ec6b17cae76878297bd1c057a0c941309519c5756225e140507594761

Download Submit
C:\Users\Admin\AppData\Local\Temp\OPH1A2PBmS.bat

Filesize
225B

MD5
d38a3a6ef8718a6db970d4479f58273f

SHA1
4fb97ccd635be8626909498edce12c2df0dba5ba

SHA256
59acd04c2ace721ee218329473a7acfb9d3a1a5a5d6a26bdab75fbb479bfa6a4

SHA512
b3b0cc2d2fdd76ae0972b78d793136a218fd24eba48f50dc3fb015cd63183255d5724c22576069c5d41c219ff363172dac1c76ba287446ac1c298c88e2b814f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat

Filesize
225B

MD5
f3e8fd16102897fd381a5f68b10c70ab

SHA1
d5e22a677ee87fcc661c0c172d170ea6bdb66e20

SHA256
f464fddd8867dbb2eb41a796edcd7f19a15ac68fd240e52ce1b17f23ee8f44cc

SHA512
f6787cfc4573d64e3bdda1e2adf1a48b33c68905cc46153c807c8e02360870a01037c65f1d09b8e4aeaf33e6fdf4bde34c0d8bd1bda085629d045598c712f56c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xEoBbgPmrR.bat

Filesize
225B

MD5
f617676d3d785a8b53e68490f7092b22

SHA1
5b2768b2e64627d67c7149e4083d090fae74a4b9

SHA256
ff3c80238093442442d8a5c30288ff9accb294814910e1e4d7377f92e0c9438d

SHA512
b4ee67eb240d5eda612f8e5503b954babfa04a0e50c78fc4cc2d2c9a0f1a71e5102182fe1e2c6ee5d4e7b39201c32970d4f51a75bb4bac83930d7ce0a74fb376

Download Submit
C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat

Filesize
225B

MD5
0bedc88122e01f241cb6411b8d5e6744

SHA1
394cab100cf148d2a0b0d24332c28355a178670b

SHA256
1b6fae39a80004a2b1899762eebaa16c4cab17fc99287755bb30af8635eed968

SHA512
e2cecdf84b06eac711d5a915aef910b003b6be4e5013d5f1fe22ea551428ac858bd429d721c541d5f10130bfcacef890a0a1e6dea593fd162eb5f465bf66d430

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7079f241f0bcdff18ea6de131f8fbc56

SHA1
461d8bba39108e227558d38ba67b009c6d52d9fa

SHA256
5c4ec85878857b813f809ef79d1bab8307d86419dc71099d7438886074c1647b

SHA512
fbb6200c1fd48864be42fe256a8dfa7ff040c096f3d97eee4c0baadaca6be17b508c850b0f8b8b07a6cd877707f99320818d306623e43ecdb47561a83d0f183d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1028-762-0x0000000000FE0000-0x00000000010F0000-memory.dmp

Filesize
1.1MB

Download
memory/1336-222-0x00000000003D0000-0x00000000004E0000-memory.dmp

Filesize
1.1MB

Download
memory/1476-283-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1476-282-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download
memory/1952-403-0x0000000001380000-0x0000000001490000-memory.dmp

Filesize
1.1MB

Download
memory/2016-582-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2040-702-0x0000000000920000-0x0000000000A30000-memory.dmp

Filesize
1.1MB

Download
memory/2104-642-0x00000000000B0000-0x00000000001C0000-memory.dmp

Filesize
1.1MB

Download
memory/2124-62-0x0000000000890000-0x00000000009A0000-memory.dmp

Filesize
1.1MB

Download
memory/2144-343-0x0000000000DC0000-0x0000000000ED0000-memory.dmp

Filesize
1.1MB

Download
memory/2600-98-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/2704-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2704-16-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2704-15-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2704-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2704-13-0x0000000000B50000-0x0000000000C60000-memory.dmp

Filesize
1.1MB

Download
memory/2724-104-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/3036-522-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download