dcrat | c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe
Size

1.3MB
MD5

96151ae8a24af8f51f588069a1d46afb
SHA1

fdb848eb86e671c9190b5fc40449cf16f43eb7ce
SHA256

c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee
SHA512

8f2d2d4b35227aa10f0639b6ae386e0b86b5429c3c1fc204354dcd37748ac46716ca8032b78e0f4365cb6f0174943977e16399ae73185cdb000f9a9683b48652
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2208	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2208	schtasks.exe	32

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d71-9.dat	dcrat
behavioral1/memory/2776-13-0x0000000000060000-0x0000000000170000-memory.dmp	dcrat
behavioral1/memory/1812-158-0x0000000000270000-0x0000000000380000-memory.dmp	dcrat
behavioral1/memory/2792-217-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/2224-395-0x0000000000D00000-0x0000000000E10000-memory.dmp	dcrat
behavioral1/memory/2792-455-0x0000000000F90000-0x00000000010A0000-memory.dmp	dcrat
behavioral1/memory/2796-516-0x0000000000020000-0x0000000000130000-memory.dmp	dcrat
behavioral1/memory/1028-576-0x0000000001270000-0x0000000001380000-memory.dmp	dcrat
behavioral1/memory/1836-636-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2440-697-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
296	powershell.exe
1800	powershell.exe
2072	powershell.exe
1676	powershell.exe
1712	powershell.exe
2084	powershell.exe
1844	powershell.exe
2784	powershell.exe
1928	powershell.exe
2660	powershell.exe
2500	powershell.exe
2744	powershell.exe
1936	powershell.exe
2476	powershell.exe
1368	powershell.exe
1072	powershell.exe
1320	powershell.exe
2772	powershell.exe
2240	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2776	DllCommonsvc.exe
1964	DllCommonsvc.exe
1812	spoolsv.exe
2792	spoolsv.exe
3036	spoolsv.exe
1992	spoolsv.exe
2224	spoolsv.exe
2792	spoolsv.exe
2796	spoolsv.exe
1028	spoolsv.exe
1836	spoolsv.exe
2440	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
2272	cmd.exe
2272	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
28	raw.githubusercontent.com
32	raw.githubusercontent.com
15	raw.githubusercontent.com
19	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
22	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\0a1fd5f707cd16	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Media Player\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\conhost.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\ScanFile\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\ScanFile\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2528	schtasks.exe
2196	schtasks.exe
2236	schtasks.exe
692	schtasks.exe
3060	schtasks.exe
1684	schtasks.exe
336	schtasks.exe
2788	schtasks.exe
2596	schtasks.exe
2600	schtasks.exe
2052	schtasks.exe
2316	schtasks.exe
2692	schtasks.exe
2536	schtasks.exe
2280	schtasks.exe
1348	schtasks.exe
3028	schtasks.exe
2764	schtasks.exe
2872	schtasks.exe
2736	schtasks.exe
1992	schtasks.exe
2660	schtasks.exe
2224	schtasks.exe
292	schtasks.exe
844	schtasks.exe
2916	schtasks.exe
756	schtasks.exe
2260	schtasks.exe
836	schtasks.exe
2648	schtasks.exe
2760	schtasks.exe
308	schtasks.exe
3048	schtasks.exe
1036	schtasks.exe
2676	schtasks.exe
2620	schtasks.exe
3024	schtasks.exe
2372	schtasks.exe
2252	schtasks.exe
1524	schtasks.exe
2680	schtasks.exe
2164	schtasks.exe
2668	schtasks.exe
2704	schtasks.exe
2716	schtasks.exe
2540	schtasks.exe
1844	schtasks.exe
1904	schtasks.exe
1652	schtasks.exe
2600	schtasks.exe
2556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2776	DllCommonsvc.exe
1712	powershell.exe
1936	powershell.exe
2744	powershell.exe
1368	powershell.exe
2476	powershell.exe
296	powershell.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
1964	DllCommonsvc.exe
2240	powershell.exe
1800	powershell.exe
2084	powershell.exe
1928	powershell.exe
1844	powershell.exe
2784	powershell.exe
2772	powershell.exe
2500	powershell.exe
1676	powershell.exe
2660	powershell.exe
2072	powershell.exe
1072	powershell.exe
1320	powershell.exe
1812	spoolsv.exe
2792	spoolsv.exe
3036	spoolsv.exe
1992	spoolsv.exe
2224	spoolsv.exe
2792	spoolsv.exe
2796	spoolsv.exe
1028	spoolsv.exe
1836	spoolsv.exe
2440	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	DllCommonsvc.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	1964	DllCommonsvc.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	1812	spoolsv.exe
Token: SeDebugPrivilege	2792	spoolsv.exe
Token: SeDebugPrivilege	3036	spoolsv.exe
Token: SeDebugPrivilege	1992	spoolsv.exe
Token: SeDebugPrivilege	2224	spoolsv.exe
Token: SeDebugPrivilege	2792	spoolsv.exe
Token: SeDebugPrivilege	2796	spoolsv.exe
Token: SeDebugPrivilege	1028	spoolsv.exe
Token: SeDebugPrivilege	1836	spoolsv.exe
Token: SeDebugPrivilege	2440	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2236	2296	JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe	28
PID 2296 wrote to memory of 2236	2296	JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe	28
PID 2296 wrote to memory of 2236	2296	JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe	28
PID 2296 wrote to memory of 2236	2296	JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe	28
PID 2236 wrote to memory of 2272	2236	WScript.exe	29
PID 2236 wrote to memory of 2272	2236	WScript.exe	29
PID 2236 wrote to memory of 2272	2236	WScript.exe	29
PID 2236 wrote to memory of 2272	2236	WScript.exe	29
PID 2272 wrote to memory of 2776	2272	cmd.exe	31
PID 2272 wrote to memory of 2776	2272	cmd.exe	31
PID 2272 wrote to memory of 2776	2272	cmd.exe	31
PID 2272 wrote to memory of 2776	2272	cmd.exe	31
PID 2776 wrote to memory of 2476	2776	DllCommonsvc.exe	48
PID 2776 wrote to memory of 2476	2776	DllCommonsvc.exe	48
PID 2776 wrote to memory of 2476	2776	DllCommonsvc.exe	48
PID 2776 wrote to memory of 1936	2776	DllCommonsvc.exe	49
PID 2776 wrote to memory of 1936	2776	DllCommonsvc.exe	49
PID 2776 wrote to memory of 1936	2776	DllCommonsvc.exe	49
PID 2776 wrote to memory of 2744	2776	DllCommonsvc.exe	50
PID 2776 wrote to memory of 2744	2776	DllCommonsvc.exe	50
PID 2776 wrote to memory of 2744	2776	DllCommonsvc.exe	50
PID 2776 wrote to memory of 296	2776	DllCommonsvc.exe	52
PID 2776 wrote to memory of 296	2776	DllCommonsvc.exe	52
PID 2776 wrote to memory of 296	2776	DllCommonsvc.exe	52
PID 2776 wrote to memory of 1712	2776	DllCommonsvc.exe	54
PID 2776 wrote to memory of 1712	2776	DllCommonsvc.exe	54
PID 2776 wrote to memory of 1712	2776	DllCommonsvc.exe	54
PID 2776 wrote to memory of 1368	2776	DllCommonsvc.exe	56
PID 2776 wrote to memory of 1368	2776	DllCommonsvc.exe	56
PID 2776 wrote to memory of 1368	2776	DllCommonsvc.exe	56
PID 2776 wrote to memory of 1964	2776	DllCommonsvc.exe	60
PID 2776 wrote to memory of 1964	2776	DllCommonsvc.exe	60
PID 2776 wrote to memory of 1964	2776	DllCommonsvc.exe	60
PID 1964 wrote to memory of 1800	1964	DllCommonsvc.exe	97
PID 1964 wrote to memory of 1800	1964	DllCommonsvc.exe	97
PID 1964 wrote to memory of 1800	1964	DllCommonsvc.exe	97
PID 1964 wrote to memory of 1072	1964	DllCommonsvc.exe	98
PID 1964 wrote to memory of 1072	1964	DllCommonsvc.exe	98
PID 1964 wrote to memory of 1072	1964	DllCommonsvc.exe	98
PID 1964 wrote to memory of 2240	1964	DllCommonsvc.exe	100
PID 1964 wrote to memory of 2240	1964	DllCommonsvc.exe	100
PID 1964 wrote to memory of 2240	1964	DllCommonsvc.exe	100
PID 1964 wrote to memory of 2772	1964	DllCommonsvc.exe	101
PID 1964 wrote to memory of 2772	1964	DllCommonsvc.exe	101
PID 1964 wrote to memory of 2772	1964	DllCommonsvc.exe	101
PID 1964 wrote to memory of 2500	1964	DllCommonsvc.exe	102
PID 1964 wrote to memory of 2500	1964	DllCommonsvc.exe	102
PID 1964 wrote to memory of 2500	1964	DllCommonsvc.exe	102
PID 1964 wrote to memory of 2660	1964	DllCommonsvc.exe	103
PID 1964 wrote to memory of 2660	1964	DllCommonsvc.exe	103
PID 1964 wrote to memory of 2660	1964	DllCommonsvc.exe	103
PID 1964 wrote to memory of 1320	1964	DllCommonsvc.exe	104
PID 1964 wrote to memory of 1320	1964	DllCommonsvc.exe	104
PID 1964 wrote to memory of 1320	1964	DllCommonsvc.exe	104
PID 1964 wrote to memory of 1928	1964	DllCommonsvc.exe	105
PID 1964 wrote to memory of 1928	1964	DllCommonsvc.exe	105
PID 1964 wrote to memory of 1928	1964	DllCommonsvc.exe	105
PID 1964 wrote to memory of 2784	1964	DllCommonsvc.exe	106
PID 1964 wrote to memory of 2784	1964	DllCommonsvc.exe	106
PID 1964 wrote to memory of 2784	1964	DllCommonsvc.exe	106
PID 1964 wrote to memory of 1676	1964	DllCommonsvc.exe	107
PID 1964 wrote to memory of 1676	1964	DllCommonsvc.exe	107
PID 1964 wrote to memory of 1676	1964	DllCommonsvc.exe	107
PID 1964 wrote to memory of 1844	1964	DllCommonsvc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c1272e6f60c9ea8fc6befbaddd5df976b3f6db87454a810d3da68ae3a1b1c4ee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:296
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Purble Place\es-ES\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\spoolsv.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\ScanFile\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PwLPF5NLF7.bat"
        6⤵
        
        PID:1992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2040
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
        8⤵
        
        PID:1452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2648
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"
        10⤵
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2084
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\avPRQTW9Zy.bat"
        12⤵
        
        PID:692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2920
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat"
        14⤵
        
        PID:1668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1184
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat"
        16⤵
        
        PID:1492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1508
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat"
        18⤵
        
        PID:1948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2940
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat"
        20⤵
        
        PID:2536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1152
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat"
        22⤵
        
        PID:2704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2428
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ay7XDWEJg9.bat"
        24⤵
        
        PID:1232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1856
        
        C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe
        
        "C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Games\Purble Place\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Purble Place\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Games\Purble Place\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Desktop\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Videos\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\ScanFile\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\ScanFile\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\ScanFile\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2feddc2c1f52a138c1fa24c3363ce60c

SHA1
1371d34d0baa6ca905f6165e700bf02e303c6f4c

SHA256
c2bd16371ae41d020e61daaf7fe43a6433cc146d068e3ef2d58540637eb84361

SHA512
3076b008bd094dd3b81006f7d57ba93fe062949c83cde37db3cf05954f8d72e0381e3d8fa6682694a495b7d11939e6c58f9232ca5a18a86e8679436b34aaeff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9364645ce40867a78135c696117204b2

SHA1
8ca55b7cb60a5a5bbaccb70a240a277aca6100d0

SHA256
61962e2cc2a44ff73a51dc1f8bdfa4154dea3206a5e35b5d548e110205e51395

SHA512
894bf5be65b4c418ce5980dc2c958f37a9a0dc795135dd4ad62f87e174fb50aa50588854ec31cfd143f119d7ad1d57f427aae6ffb350dd9cdb74e00da4ecad43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb24afdc2e5b23afa0934b7bfb976765

SHA1
e65e56eb0110bdc40202176ff685fc6243017075

SHA256
3b79d2359980f41e6cfe9493026f70bdac8417aba85e9f67d677b521110d68e6

SHA512
44c2d1249cf42bc7ea5c851a2781805f0c985be4b78755866184d12ca994096ab9fe8a797f657b34c80ded6b6a846f29c5b32e230177ad21aa50ebfce130a6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbc6bf5144596cd66076a9b8b332dfe9

SHA1
5faa99141f5717ed657896077cbf344651ad6da6

SHA256
2d7bf9b4c9de4e3869f168e5157613158dd1672c031619a9d02beac76a34204b

SHA512
572b2061889e0f359ef8901f29ee055a82493acf41a3840a7deec6afa68d3d105d15d43877bc37a53eefe31bce798c0b46d38ca76f6e26c82261d6a5221d6e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f86f4ef25970a975ecffc81543a1c9d5

SHA1
2b2b2b6861199b196b6f5da6376cbf5e1a674ebb

SHA256
54968601188be3f7220fd6146e36283c77343827cc74194490c4df6f2cccfdf9

SHA512
1eeadce9d1041632abae5716e00e6543aa1cbfec0e7767f1fb38cd08a20c117f81606e6a32ee0ada6d347c8181ebaca8cc989a667c397b6dd6b15ad259f69df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
054936502df331b7a39da73896ed7191

SHA1
a8c73bceaf8996c15bc1dd3e68d6b7a462614ae5

SHA256
ca873f00337e8b042d5ee1525943e715841b83ddab9b88995270522f7a007e6a

SHA512
8c42890d2eb9b83c3a8d09b65c61d56ea27f1bf51bb321fcb79356b96acd24500ca1b3717e68402d6c1913ee0e39c79d05a1733a8a237817c641f32dae3b751d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3afe4c545682fee9daeb877bc0da1dd

SHA1
13bed7bd39306f55a1c98426542cf4b95b78329e

SHA256
90dd97ade108e8170a8356c24a1b62d3071c10b946fa84db522a8b5985675228

SHA512
68084d4f551685ddcf473cac9575f49d46ef83249862588e27991a4586b5dddfe4f82bf263c87252824ea39c311a04b725f27ed7eb7bae6745339df76657d0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3648feacd216eaca7a77516d9b282370

SHA1
adf390f9be7eebd5f04b919dd90529c3437a1e58

SHA256
3a75e4dc4cc336771bb88c202be43878d89b1a05b11a307b76915179573091c4

SHA512
b8ae5e9d68304c84621f10f5202a0e4e146bcca56a706171c704035bca413e4b57d304ea9f42d5cc983f162f24446959e3492b905160d03b833913d377bad474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a785d2b3e5623f115b1149d28bd9bc1

SHA1
54cac3dae0dc4bd6aab4d7ba5fc52c8524a0035d

SHA256
6c77eb2f8467a1408d8dae64a034bf7722fd99a07e245ab9f1aaab6ff6b4d70b

SHA512
fb11bff0f09c4c45e31c9c7a93ad8d6ca8d2f0adabbc8cb6ff8ff5b7215a2ffec9519fc558c08dfc18666608eafe9bfe2dd29aa5e6dd117dace70249bde46523

Download Submit
C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat

Filesize
236B

MD5
5b4c364348e1e741cdc12b08b28cee35

SHA1
58872701f05adef1d6766ad99257992443d90395

SHA256
23d2710a9965cdd33effc9e420e84081badd8a63673d58f9619e318a906007aa

SHA512
e7df974b95064dce02b2cae117d62eecd145b311cbdeac6007fa41b2458993de854112116216100b927dd5c5dca817ce908df11633ddf6b290cdf9671f2b9edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ay7XDWEJg9.bat

Filesize
236B

MD5
c15532631888c91083d82aa10400b2ac

SHA1
6ada2fa0d419d77248d94a4c9d9d296368f9ba8f

SHA256
1de71f2ac4ab660ad4b75193b047f2c0591953325dd10d52cdc80ac052521a25

SHA512
03d8cd0c5aae97b3de1648626f0f913016a65e0afefcfbff9a70cb134a17313da7ee5587045119778b44e36d9967fee628bf92b3c5a0ae9333dad88430290291

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB6A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat

Filesize
236B

MD5
fef70634e3527ee793d8ee02c009effc

SHA1
a3bbb4c039e25e70339f2ddcac79de386faa8bdf

SHA256
13eacd1e0ef509eb4f5ac0daaa0b03a53a90625b9c6bf439e5dc38c68330438b

SHA512
1191f584b7f154da91bdb6d84dafe3798ca1cf86eb0aa668d71acb85cd64cb6c67193a8bdc059b48cfc8983204253980163b5ede63b3e194fe410c648378b117

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat

Filesize
236B

MD5
dd7f05d5673b80d943c79da403bc93eb

SHA1
17c5dac1d059c3147528edc423615d6cffc99219

SHA256
61a35696c028cef0c9a346c4db9387697e6adbe1bb7862be7666d28ba6daa9f9

SHA512
b4db5f4055bcecf45913ceee4abf2c215d891ecb4ccdb3b4b8458b2e2c5ac892cf6b1ab634130a09c07310828808a9c3c71d11874ea64b804dca0a46e393632d

Download Submit
C:\Users\Admin\AppData\Local\Temp\PwLPF5NLF7.bat

Filesize
236B

MD5
d332137874bb4df5140c38cc97439f93

SHA1
c595c7f7226b5d78ab95680ff750652e81a85b85

SHA256
7ad722aedbaf270b33fe2c1d1f80850eb9152f740926509b3e6bbed9a65b456b

SHA512
aae977af13b6ad99fc46a726ec8ed6eb9f58fadc088ebf8e3d0b9d403bab9a341a0b3ee7078c18c48ac4e5f7b888cf855134703578deddc5741d178d029c64f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB8C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat

Filesize
236B

MD5
4d7fc9ddbf11f8caa3fe4e6074590beb

SHA1
d6088741d37769144e99be0b641fa190b95eabed

SHA256
b623e4b5f05a9c57777c6590f9cbbd73ff0faeffcf1a9c0bdec7ae5314167375

SHA512
bde4fc0db3eab88771ea91da602a7cd586f67de59b79222a54bc1f9f1c6100a3d860f1a50710ae113ced867b60bfa9f1aab7bf296921d2684f236e6b69d59344

Download Submit
C:\Users\Admin\AppData\Local\Temp\avPRQTW9Zy.bat

Filesize
236B

MD5
6b7bfc9b5a9f4f82a033428997683555

SHA1
3e5f91a1152033f784f63bf781c029428f5375bb

SHA256
c8ebb10bfeb680eddd5402db242dc5a062871b8906ecd7149d98670d4fb49d13

SHA512
00d2a4344fd76b55bb132f7d221c19e5cbeab87505cff5bda81cf7a7788165c33672ac5b6cc1827379021da753e3559bcdea0336785bba70d9d2e28d7cbb7afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat

Filesize
236B

MD5
602596dc6fdfd9f89f6eae3453968864

SHA1
f1894b1fff0cc234c65ed3ad1845f2638cca4e26

SHA256
71c31ed71703166214c3f15f6daad6ca86e684b7bf9d4d4ebb44ce85d7e4b92b

SHA512
7cb518d3f0fb6f3f32323090c8842ef04336ed8afe7edf1740b9b28172d2d0e76bcde81d59071ddf1f250e15875a5492a7d474d37a41e47e46f335e95b072e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

Filesize
236B

MD5
5baa8a31cb46da2161a75c550ab58b36

SHA1
1bb04b26aa7476d5ba66abb169733871035c54fc

SHA256
b532a9115ced481c448fd3d3030f32c5588051f5f7341923881c9f36a3625677

SHA512
c330c663734c7a9e43eee385207568e51547eab62f2c68a6259c66bb2f9d434697355adb4eb5a6f576a7324159252dd4eab8a1f49cb154fd6887f1213375692c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat

Filesize
236B

MD5
c1658957431186c74d9d39f28c62c898

SHA1
d60a6ca688cb59998598daaf09f563b0ee87b62d

SHA256
0340ada79f187f8b2f917a6855dd9790135c5f08fa5a683edb7eadad68c4d86c

SHA512
c2375a81a1c39235e95374b6846a37c5330721a47951e48dbe6e41b7030ac7a495589195c2ca135692e1d66a50ece6011e59e1cb78d1c7018df094818c32f2ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9a91f1510d1e453cc321f3a60c1e3c87

SHA1
cde511af7b666816eb7b15f604464bc0ead249d9

SHA256
d54726f70333379ac19b8c9a4675a3b3acdfac4cffe2bea5851197009441603e

SHA512
86a1ad9755a74118f491e46d6d0f6066d2cbbf847660e76eda35b1041acac33f79d197965e969fae61f897d2ccf65434ded27f250b35288de57b96bec5623f28

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1028-576-0x0000000001270000-0x0000000001380000-memory.dmp

Filesize
1.1MB

Download
memory/1712-39-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/1712-38-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/1812-158-0x0000000000270000-0x0000000000380000-memory.dmp

Filesize
1.1MB

Download
memory/1836-637-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1836-636-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2224-395-0x0000000000D00000-0x0000000000E10000-memory.dmp

Filesize
1.1MB

Download
memory/2240-100-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2240-99-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2440-697-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2440-698-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/2776-17-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/2776-16-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/2776-15-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2776-14-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/2776-13-0x0000000000060000-0x0000000000170000-memory.dmp

Filesize
1.1MB

Download
memory/2792-217-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/2792-456-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/2792-455-0x0000000000F90000-0x00000000010A0000-memory.dmp

Filesize
1.1MB

Download
memory/2796-516-0x0000000000020000-0x0000000000130000-memory.dmp

Filesize
1.1MB

Download