dcrat | 72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe
Size

1.3MB
MD5

dbf920144007e48da5141f53ab270de6
SHA1

3a860f79036f2a4d9023aaf02b322d5f5069acd1
SHA256

72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24
SHA512

d386d010da44e3ff91e0967f267262e131ae195872c0a9533404bbd9459ee6a717ed7e8953efeaaa9541f65dd6b7ed68c54936dc632cdf80288b53ab92de5738
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1532	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	1532	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cbd-9.dat	dcrat
behavioral2/memory/4924-13-0x0000000000C40000-0x0000000000D50000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3584	powershell.exe
1112	powershell.exe
2764	powershell.exe
3208	powershell.exe
764	powershell.exe
5040	powershell.exe
964	powershell.exe
4064	powershell.exe
2956	powershell.exe
3048	powershell.exe
880	powershell.exe
1664	powershell.exe
4148	powershell.exe
1128	powershell.exe
1596	powershell.exe
2820	powershell.exe
3404	powershell.exe
2232	powershell.exe
8	powershell.exe
388	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe

Executes dropped EXE 15 IoCs

pid	Process
4924	DllCommonsvc.exe
1464	DllCommonsvc.exe
2244	powershell.exe
776	powershell.exe
4148	powershell.exe
3208	powershell.exe
2108	powershell.exe
5060	powershell.exe
1580	powershell.exe
3876	powershell.exe
4824	powershell.exe
2080	powershell.exe
3708	powershell.exe
4452	powershell.exe
1664	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
37	raw.githubusercontent.com
46	raw.githubusercontent.com
47	raw.githubusercontent.com
53	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
18	raw.githubusercontent.com
19	raw.githubusercontent.com
25	raw.githubusercontent.com
41	raw.githubusercontent.com
45	raw.githubusercontent.com
54	raw.githubusercontent.com

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Oracle\Java\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\conhost.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\security\templates\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Media\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\Media\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Windows\debug\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\debug\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\rescache\_merged\powershell.exe	DllCommonsvc.exe
File created	C:\Windows\security\templates\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1700	schtasks.exe
4036	schtasks.exe
3056	schtasks.exe
4620	schtasks.exe
5084	schtasks.exe
3892	schtasks.exe
2356	schtasks.exe
2076	schtasks.exe
3508	schtasks.exe
3104	schtasks.exe
2588	schtasks.exe
4672	schtasks.exe
2052	schtasks.exe
2368	schtasks.exe
1204	schtasks.exe
3356	schtasks.exe
2040	schtasks.exe
4972	schtasks.exe
1680	schtasks.exe
1400	schtasks.exe
4484	schtasks.exe
840	schtasks.exe
3616	schtasks.exe
1596	schtasks.exe
1460	schtasks.exe
3600	schtasks.exe
1420	schtasks.exe
8	schtasks.exe
996	schtasks.exe
984	schtasks.exe
3364	schtasks.exe
1956	schtasks.exe
720	schtasks.exe
1068	schtasks.exe
3972	schtasks.exe
3136	schtasks.exe
3708	schtasks.exe
3900	schtasks.exe
4380	schtasks.exe
4776	schtasks.exe
1160	schtasks.exe
4880	schtasks.exe
1600	schtasks.exe
2344	schtasks.exe
3936	schtasks.exe
3868	schtasks.exe
5096	schtasks.exe
3752	schtasks.exe
4844	schtasks.exe
208	schtasks.exe
1392	schtasks.exe
3984	schtasks.exe
2432	schtasks.exe
4420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	DllCommonsvc.exe
3208	powershell.exe
2956	powershell.exe
3048	powershell.exe
2956	powershell.exe
1128	powershell.exe
1464	DllCommonsvc.exe
3208	powershell.exe
3048	powershell.exe
1128	powershell.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
880	powershell.exe
880	powershell.exe
388	powershell.exe
388	powershell.exe
2820	powershell.exe
2820	powershell.exe
1112	powershell.exe
1112	powershell.exe
964	powershell.exe
964	powershell.exe
1596	powershell.exe
1596	powershell.exe
3584	powershell.exe
3584	powershell.exe
2764	powershell.exe
2764	powershell.exe
8	powershell.exe
8	powershell.exe
4148	powershell.exe
4148	powershell.exe
5040	powershell.exe
5040	powershell.exe
764	powershell.exe
764	powershell.exe
1664	powershell.exe
1664	powershell.exe
2232	powershell.exe
2232	powershell.exe
3404	powershell.exe
3404	powershell.exe
4064	powershell.exe
4064	powershell.exe
5040	powershell.exe
2244	powershell.exe
2244	powershell.exe
388	powershell.exe
2820	powershell.exe
1596	powershell.exe
3584	powershell.exe
1112	powershell.exe
880	powershell.exe
880	powershell.exe
2764	powershell.exe
964	powershell.exe
4148	powershell.exe
8	powershell.exe
2232	powershell.exe
1664	powershell.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	DllCommonsvc.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	1464	DllCommonsvc.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 4052	2752	JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe	83
PID 2752 wrote to memory of 4052	2752	JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe	83
PID 2752 wrote to memory of 4052	2752	JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe	83
PID 4052 wrote to memory of 2576	4052	WScript.exe	85
PID 4052 wrote to memory of 2576	4052	WScript.exe	85
PID 4052 wrote to memory of 2576	4052	WScript.exe	85
PID 2576 wrote to memory of 4924	2576	cmd.exe	87
PID 2576 wrote to memory of 4924	2576	cmd.exe	87
PID 4924 wrote to memory of 1128	4924	DllCommonsvc.exe	99
PID 4924 wrote to memory of 1128	4924	DllCommonsvc.exe	99
PID 4924 wrote to memory of 3208	4924	DllCommonsvc.exe	100
PID 4924 wrote to memory of 3208	4924	DllCommonsvc.exe	100
PID 4924 wrote to memory of 2956	4924	DllCommonsvc.exe	101
PID 4924 wrote to memory of 2956	4924	DllCommonsvc.exe	101
PID 4924 wrote to memory of 3048	4924	DllCommonsvc.exe	102
PID 4924 wrote to memory of 3048	4924	DllCommonsvc.exe	102
PID 4924 wrote to memory of 1464	4924	DllCommonsvc.exe	106
PID 4924 wrote to memory of 1464	4924	DllCommonsvc.exe	106
PID 1464 wrote to memory of 880	1464	DllCommonsvc.exe	153
PID 1464 wrote to memory of 880	1464	DllCommonsvc.exe	153
PID 1464 wrote to memory of 388	1464	DllCommonsvc.exe	154
PID 1464 wrote to memory of 388	1464	DllCommonsvc.exe	154
PID 1464 wrote to memory of 1596	1464	DllCommonsvc.exe	155
PID 1464 wrote to memory of 1596	1464	DllCommonsvc.exe	155
PID 1464 wrote to memory of 2820	1464	DllCommonsvc.exe	156
PID 1464 wrote to memory of 2820	1464	DllCommonsvc.exe	156
PID 1464 wrote to memory of 1664	1464	DllCommonsvc.exe	157
PID 1464 wrote to memory of 1664	1464	DllCommonsvc.exe	157
PID 1464 wrote to memory of 3584	1464	DllCommonsvc.exe	158
PID 1464 wrote to memory of 3584	1464	DllCommonsvc.exe	158
PID 1464 wrote to memory of 4148	1464	DllCommonsvc.exe	159
PID 1464 wrote to memory of 4148	1464	DllCommonsvc.exe	159
PID 1464 wrote to memory of 8	1464	DllCommonsvc.exe	160
PID 1464 wrote to memory of 8	1464	DllCommonsvc.exe	160
PID 1464 wrote to memory of 2232	1464	DllCommonsvc.exe	161
PID 1464 wrote to memory of 2232	1464	DllCommonsvc.exe	161
PID 1464 wrote to memory of 2764	1464	DllCommonsvc.exe	163
PID 1464 wrote to memory of 2764	1464	DllCommonsvc.exe	163
PID 1464 wrote to memory of 964	1464	DllCommonsvc.exe	164
PID 1464 wrote to memory of 964	1464	DllCommonsvc.exe	164
PID 1464 wrote to memory of 5040	1464	DllCommonsvc.exe	165
PID 1464 wrote to memory of 5040	1464	DllCommonsvc.exe	165
PID 1464 wrote to memory of 764	1464	DllCommonsvc.exe	166
PID 1464 wrote to memory of 764	1464	DllCommonsvc.exe	166
PID 1464 wrote to memory of 3404	1464	DllCommonsvc.exe	167
PID 1464 wrote to memory of 3404	1464	DllCommonsvc.exe	167
PID 1464 wrote to memory of 1112	1464	DllCommonsvc.exe	169
PID 1464 wrote to memory of 1112	1464	DllCommonsvc.exe	169
PID 1464 wrote to memory of 4064	1464	DllCommonsvc.exe	170
PID 1464 wrote to memory of 4064	1464	DllCommonsvc.exe	170
PID 1464 wrote to memory of 2244	1464	DllCommonsvc.exe	185
PID 1464 wrote to memory of 2244	1464	DllCommonsvc.exe	185
PID 2244 wrote to memory of 4068	2244	powershell.exe	193
PID 2244 wrote to memory of 4068	2244	powershell.exe	193
PID 4068 wrote to memory of 1772	4068	cmd.exe	195
PID 4068 wrote to memory of 1772	4068	cmd.exe	195
PID 4068 wrote to memory of 776	4068	cmd.exe	202
PID 4068 wrote to memory of 776	4068	cmd.exe	202
PID 776 wrote to memory of 1752	776	powershell.exe	205
PID 776 wrote to memory of 1752	776	powershell.exe	205
PID 1752 wrote to memory of 2100	1752	cmd.exe	207
PID 1752 wrote to memory of 2100	1752	cmd.exe	207
PID 1752 wrote to memory of 4148	1752	cmd.exe	209
PID 1752 wrote to memory of 4148	1752	cmd.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_72e47d638f9c345e1cb70c44a835fd3bfcb222e24a932efa7413f9640a8b0c24.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1464
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Oracle\Java\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\sihost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\templates\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\winlogon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\fontdrvhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\TextInputHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\RuntimeBroker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
      - C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1772
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2100
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat"
        11⤵
        
        PID:4924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4776
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat"
        13⤵
        
        PID:4836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3108
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FdUsM3mSuD.bat"
        15⤵
        
        PID:3412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1892
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
        17⤵
        
        PID:2716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3656
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat"
        19⤵
        
        PID:516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2580
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aJcBxrOCPY.bat"
        21⤵
        
        PID:3592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3060
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"
        23⤵
        
        PID:3664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3668
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"
        25⤵
        
        PID:1572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4964
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
        27⤵
        
        PID:1860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:776
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat"
        29⤵
        
        PID:3916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3944
        
        C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe
        
        "C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\security\templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\security\templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\security\templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Media\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Media\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\debug\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
89b9b22e2cb6f0b903e7f8755f49d7be

SHA1
e13b62b19dccdbacb5fec9227e34f21e34fe5cad

SHA256
17b31393e036af7d83e6ea288a0bbad0278c404f5e0698b3a28f2fa1faa99537

SHA512
f4817348aa7f297c7c81db010bc0ce09c9193c32f0f7c2b0592df0c7731921830b5a3868486f986edfd863d7d82815e67598392b94782b9d317b7066b9fb7064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6bf2927575032d77fab2956579e56348

SHA1
55bfbdacbf4a787b232793f19eca4df667722621

SHA256
a8f97ad6d46dc8b95328e3d85c48451537b2c71855a5913f7b2f3305dab0b6f0

SHA512
7649c7f3c6d753ce6d374798f1f9e0bc6aa84fd445407bd0a0a4cfaa6f48c5d54deb0c836b39b5104c9e82922c0daa84fe824c43f84ae89860c7d1c68610decc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60a51f9d8f9bb2aeed1795cb95267627

SHA1
0cbd4d0ee1f13653131be4599e0308d8b38f5b5a

SHA256
f68c7b2277ee0e3ebfa32594b5382f1f97e749027272f3ebaf93fbc278c15907

SHA512
46c278007ac3eb31766a431a382c5971778dfc87586a9033d203064799b37d604166885a8f458eb40737cf951142ac4cccd8781caea899c3b8390ee29c664d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8609c12c59293ee67562f5096525f6f

SHA1
7b89311e1e00dec0658daa7749b6560af217435c

SHA256
9e7a84df1f437f21ceba6e519fbbd333f0bd7721e8e4b0bb963652fb9a1163fa

SHA512
ce6838f441c0954739ec5e03af0726d20b892c4415df3c3ee2010bc6c8f6191ac6717d0e3499ce04a03441b1ad43fc7a2df0de34a1ebd67fbd62cfdf48007b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
532039db5b74a53a4aec41f30c0b499c

SHA1
fec9266181bf5fcb07528d63e58583ad36cb9499

SHA256
a5cdd90669758015e8e265033660a4d048a27ee5988d2100cc49a109e2ff9601

SHA512
b5c9e9da4f5fbdd971b727934d86ea91baeeb681eaeddfb6aec15d9b583944a3edbc05a35fff17e13a36b06dad6c6334bdeb527ba5128aec86ad61716b4f183e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4345955c1b5cc2f2c8a6923e677f6a61

SHA1
572a46a5fa74524df83da70b00f40ddb81b5b432

SHA256
14178c711c1c432e590041f1c4e426b664b07b1c3aad6c84b352677330ce3fef

SHA512
6bc29254e9aa6e12b353979f4e3b7689fe586bdcc6a6605f540b9202ab70c7b6c1cf28b25d7d69e8569917b183f62f0f40c8689e9e5d0134b2b6f1c306cbd2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8fbdf20dd30b6ccf91308090184986d8

SHA1
fde6e3a60582552e322af16289c63d6943a18a78

SHA256
3b67692f7e6b5569626ecbf266289b9ae7cb4dc40ee5165eb6c6ea70c5f1f78b

SHA512
3ceefad823f555c522d46b266a6c77ea51002f1fb7426992f8a4ea70f0b9cf1ab6979db319c480cfcd51dc393407d3de5e111368b951a6d15766aa296045ffee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat

Filesize
234B

MD5
4050b4cb378bb583adde895c5c92a366

SHA1
71e05272df6a3eb0b2af7db4444cc7e55d205df8

SHA256
49514557dc291cc7b391c2dc164cc743aaba9982c21344f69d61af8fda8652e7

SHA512
a76960c3f7ca78c59b046310b57e07ccddc7cb7c8573a5317eaea53bd82fc632b5c8ec7fb82423e09f8f8ba1fbb244330f92c3b93299705b540ea9dbc9a9be43

Download Submit
C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat

Filesize
234B

MD5
40a012efe7788ac7f1602b23b35dfc51

SHA1
d4b91448e340ca9e9227340d33e50d33e8c915e8

SHA256
4c65f0f1b377d1bd522c2493f854411569546dba0a6a0f07c6d23f3867da5c2e

SHA512
860659fee7063e50c65c6e74c964f2595cf1d68460a466f162bd05d148a9c2079dd861e5aebfdc4d7e1dfd0fa74f1d17c66a0ec8e8facf59d7096dc66060ed5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FdUsM3mSuD.bat

Filesize
234B

MD5
d52ff17433b5179e1d8e213bb59c51e6

SHA1
a4f9d5f70d22312d241e1ea37fe0cce6949c1187

SHA256
db7d14e7234d2929d3eae26a30c08e66c1d4c04302b0c52e1531d49a35854b93

SHA512
66244a2fd8d79ac1effef15fbc3784f6854411f5db22688468d494e5c17e7142eb226bc157661df5e832c0b76370f67be8fb164a9d34b655d92429eb1cd0e380

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat

Filesize
234B

MD5
5517d60de204ad8b65b11fc1c3697229

SHA1
6dd8a138930ab899dd9416b6e1ad033beb5e8558

SHA256
43125b779a77a899a2357ba58ae280b3e4301f3c196b9c3613cb01d54356c007

SHA512
1967b8f60acb06bfa8956aec7b432a48040a98751484ae06f20ceff9c54a21e22ba9cf55b3cd4a0d695d2a9a214ab05a59c228985aec88122ac9c8e3c23da953

Download Submit
C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat

Filesize
234B

MD5
71363a6e18d7452b3cf5aef815d1f3b4

SHA1
de94e34fcd16ed30289e89b30e145faf06daa1ac

SHA256
40c40f8a35058cfce694df1b2f8536a61404e6057abcb524ff5fe41d7dbac43c

SHA512
f0b2f8e59a83ec36ef328b6ca08c54a7f1c7ff9e6bd4b99b6f63dd9527a67c8de52e666a0ed2c0768e96ce4e316bda17b2e72539249739e7d95996eeab3eac78

Download Submit
C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat

Filesize
234B

MD5
0c0c66d44dea873d85292f906d4349b8

SHA1
01af110072889fbf1744622e910b5bdb8f0999e1

SHA256
43f57a2fad56c61d366c70e7192675aaa51404dddec7c866652ee44084cab989

SHA512
9191793726f4ab27275e0a2c337099e5bf61eaff0a8a5366e092f263fafd6614699d3de67e8dd3e5cd012383986483ec5c5e67b766b196ec02daf408078ba82f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

Filesize
234B

MD5
6c4c5b766d9702f758ba35059666eb63

SHA1
2bfeffb70898d79320b5cbbc3cf27e9de7db4254

SHA256
7b6be6be793154171147695ac7f778fb018fe883f66a9517f8837689d8347fb8

SHA512
d5c4c3aacb083ef19648cf18286d14dc89499891258630c513dfb1c4661c868eeac369d2326a936aad5e1ae2e89c40583654cf461cf8bd58981db223ae6768bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat

Filesize
234B

MD5
97cbea561de02ba0b217dc0b66536656

SHA1
832790633c045af4d1cda2b35c404a845dd04d74

SHA256
877bb169d519a362011a048a744655be0af0da30bbb3085276d14b2aae30f609

SHA512
00cca64873db07e5e3529aadc748c07c686a5bd891cfba7fb28445745d76aa1679b0f652ac5e7303c64682cec80d778d143097b8698f0a89b69a27960bc43bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1gezxzd5.zxq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aJcBxrOCPY.bat

Filesize
234B

MD5
72f3f9f1544f2e8e6f927298a8b75113

SHA1
5f97d36872c6baa1fceff8a973e7c03755d86579

SHA256
778a90465b924d2e279444ed8d9d759692fb9b85cfbbfee39751b6ea5842eadd

SHA512
1da40953163aa95c149c3bf7d66df00953d267ad16fdef8c3ea5389229d94ea6c60b0feb4e2b61cb15a109bd0aefadc39513a12bc0d566166f1a70d52f464f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat

Filesize
234B

MD5
6c9a2c83f4e8b6675940303433ee485d

SHA1
800c3bb7db4f8dfb56fb97ef28b3b24027794e69

SHA256
8f8608026811a7b2c01e9ef9767845030a4509877aa0e5f6a347790cea76c4aa

SHA512
b9db72274eee66edd9c47e8467b124659eb1d15cfdf4515b19b7db51262beecb575b4831e95e8d2b8cd12556c543de8150372c75b997216682cf0d5282c74af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat

Filesize
234B

MD5
efe095be240b452b21cdd7c6d676bc7a

SHA1
e677d64ce3a2477cfafaaf6f198566ad0e69029b

SHA256
8f885a8ec0e3a74571abf24d729bac9fe52a8eba3804ce60baa046b275bc7188

SHA512
b2048e4f3c0df8cfe3f52299d38763b5fdb56a11ff2293a33d3b2e5f30397bf71a46b3d9f1a0f008f4835b43cbe800a3ec073d31ae8ca9a6167e0c661ba30e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat

Filesize
234B

MD5
787e848fe1f3ee400f8a8b3d040eb58e

SHA1
4f1368410bac499574950e29d927770c698810aa

SHA256
1475249a250824133ef1b7f3cdd362fc66f77b085606e41a5e37b8ab90eaf681

SHA512
b087924b7988211e3bb71d6ad26d9b272e30a6df9dfb6a9688a7633c512df57a109b258934d967207618a91f3073679dc4d15dd7b42a43df54b42b5864aa289e

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/8-277-0x0000028271C80000-0x0000028271DEA000-memory.dmp

Filesize
1.4MB

Download
memory/388-271-0x000001EC32490000-0x000001EC325FA000-memory.dmp

Filesize
1.4MB

Download
memory/764-286-0x0000015E5A590000-0x0000015E5A6FA000-memory.dmp

Filesize
1.4MB

Download
memory/880-266-0x000002692B7B0000-0x000002692B91A000-memory.dmp

Filesize
1.4MB

Download
memory/964-287-0x000002AFD1290000-0x000002AFD13FA000-memory.dmp

Filesize
1.4MB

Download
memory/1112-305-0x00000179E7F70000-0x00000179E80DA000-memory.dmp

Filesize
1.4MB

Download
memory/1580-352-0x000000001BD10000-0x000000001BE7A000-memory.dmp

Filesize
1.4MB

Download
memory/1596-265-0x0000023BC6780000-0x0000023BC68EA000-memory.dmp

Filesize
1.4MB

Download
memory/1664-295-0x0000022E49580000-0x0000022E496EA000-memory.dmp

Filesize
1.4MB

Download
memory/2108-335-0x000000001BCE0000-0x000000001BD81000-memory.dmp

Filesize
644KB

Download
memory/2108-336-0x000000001CCC0000-0x000000001CE69000-memory.dmp

Filesize
1.7MB

Download
memory/2108-338-0x000000001BCE0000-0x000000001BD81000-memory.dmp

Filesize
644KB

Download
memory/2108-339-0x000000001CCC0000-0x000000001CE69000-memory.dmp

Filesize
1.7MB

Download
memory/2232-301-0x000002D800740000-0x000002D8008AA000-memory.dmp

Filesize
1.4MB

Download
memory/2244-233-0x0000000001710000-0x0000000001722000-memory.dmp

Filesize
72KB

Download
memory/2764-285-0x0000013E7D190000-0x0000013E7D2FA000-memory.dmp

Filesize
1.4MB

Download
memory/2820-272-0x000002ADF82B0000-0x000002ADF841A000-memory.dmp

Filesize
1.4MB

Download
memory/2956-27-0x0000020FFE490000-0x0000020FFE4B2000-memory.dmp

Filesize
136KB

Download
memory/3404-298-0x000002AF4A350000-0x000002AF4A4BA000-memory.dmp

Filesize
1.4MB

Download
memory/3584-278-0x0000014DED790000-0x0000014DED8FA000-memory.dmp

Filesize
1.4MB

Download
memory/3708-374-0x0000000003130000-0x0000000003142000-memory.dmp

Filesize
72KB

Download
memory/3876-355-0x0000000001900000-0x0000000001912000-memory.dmp

Filesize
72KB

Download
memory/4064-304-0x000001144F670000-0x000001144F7DA000-memory.dmp

Filesize
1.4MB

Download
memory/4148-294-0x000001A4E26C0000-0x000001A4E282A000-memory.dmp

Filesize
1.4MB

Download
memory/4148-318-0x0000000002240000-0x0000000002252000-memory.dmp

Filesize
72KB

Download
memory/4924-17-0x000000001B970000-0x000000001B97C000-memory.dmp

Filesize
48KB

Download
memory/4924-16-0x000000001B960000-0x000000001B96C000-memory.dmp

Filesize
48KB

Download
memory/4924-15-0x0000000002E70000-0x0000000002E7C000-memory.dmp

Filesize
48KB

Download
memory/4924-14-0x0000000002E60000-0x0000000002E72000-memory.dmp

Filesize
72KB

Download
memory/4924-13-0x0000000000C40000-0x0000000000D50000-memory.dmp

Filesize
1.1MB

Download
memory/4924-12-0x00007FFABF133000-0x00007FFABF135000-memory.dmp

Filesize
8KB

Download
memory/5040-260-0x0000020B55DB0000-0x0000020B55F1A000-memory.dmp

Filesize
1.4MB

Download
memory/5060-345-0x000000001C980000-0x000000001CAEA000-memory.dmp

Filesize
1.4MB

Download