dcrat | 5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe
Size

1.3MB
MD5

5fea7c98422d6c014871e66d6ce023f4
SHA1

20651c78e1016c2745969a2cf616f225d864652f
SHA256

5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e
SHA512

956e91e189a91cd7f04a051f788a475acbad17d6396544869ecc53259a4fe0f4c2b2b7943330f6d56fbb4dff52a95debba476887dcb51230ac5c73e735dd1002
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	2776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	2776	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b81-10.dat	dcrat
behavioral2/memory/3516-13-0x0000000000FE0000-0x00000000010F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3508	powershell.exe
3436	powershell.exe
1240	powershell.exe
4716	powershell.exe
4256	powershell.exe
1668	powershell.exe
3172	powershell.exe
1568	powershell.exe
4904	powershell.exe
704	powershell.exe
4504	powershell.exe
4972	powershell.exe
4756	powershell.exe
1080	powershell.exe
3364	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe

Executes dropped EXE 16 IoCs

pid	Process
3516	DllCommonsvc.exe
1140	DllCommonsvc.exe
1108	SppExtComObj.exe
1836	SppExtComObj.exe
1580	SppExtComObj.exe
1116	SppExtComObj.exe
2224	SppExtComObj.exe
3104	SppExtComObj.exe
2780	SppExtComObj.exe
4652	SppExtComObj.exe
5068	SppExtComObj.exe
3544	SppExtComObj.exe
1860	SppExtComObj.exe
5072	SppExtComObj.exe
1300	SppExtComObj.exe
1496	SppExtComObj.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com
42	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
36	raw.githubusercontent.com
48	raw.githubusercontent.com
50	raw.githubusercontent.com
41	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
23	raw.githubusercontent.com
35	raw.githubusercontent.com
39	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\attachments\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\attachments\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\attachments\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Visualizations\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\0a1fd5f707cd16	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\f3b6ecef712a24	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1716	schtasks.exe
1636	schtasks.exe
2664	schtasks.exe
1388	schtasks.exe
212	schtasks.exe
1496	schtasks.exe
1632	schtasks.exe
1648	schtasks.exe
3512	schtasks.exe
4784	schtasks.exe
536	schtasks.exe
1956	schtasks.exe
3592	schtasks.exe
232	schtasks.exe
2252	schtasks.exe
2576	schtasks.exe
4944	schtasks.exe
1836	schtasks.exe
516	schtasks.exe
4884	schtasks.exe
1404	schtasks.exe
1776	schtasks.exe
4772	schtasks.exe
4924	schtasks.exe
4792	schtasks.exe
1628	schtasks.exe
1860	schtasks.exe
3376	schtasks.exe
2348	schtasks.exe
4472	schtasks.exe
1112	schtasks.exe
1552	schtasks.exe
3596	schtasks.exe
4296	schtasks.exe
4856	schtasks.exe
4568	schtasks.exe
1484	schtasks.exe
4108	schtasks.exe
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	DllCommonsvc.exe
3516	DllCommonsvc.exe
3516	DllCommonsvc.exe
3516	DllCommonsvc.exe
3516	DllCommonsvc.exe
3516	DllCommonsvc.exe
3516	DllCommonsvc.exe
4972	powershell.exe
4972	powershell.exe
1668	powershell.exe
4904	powershell.exe
1668	powershell.exe
4904	powershell.exe
1140	DllCommonsvc.exe
1140	DllCommonsvc.exe
1140	DllCommonsvc.exe
1140	DllCommonsvc.exe
1140	DllCommonsvc.exe
1140	DllCommonsvc.exe
4756	powershell.exe
4756	powershell.exe
4504	powershell.exe
4504	powershell.exe
1240	powershell.exe
1240	powershell.exe
3172	powershell.exe
3172	powershell.exe
704	powershell.exe
704	powershell.exe
1568	powershell.exe
1568	powershell.exe
4256	powershell.exe
4256	powershell.exe
4716	powershell.exe
4716	powershell.exe
3364	powershell.exe
3364	powershell.exe
3436	powershell.exe
3436	powershell.exe
3508	powershell.exe
3508	powershell.exe
1080	powershell.exe
1080	powershell.exe
1240	powershell.exe
4504	powershell.exe
4756	powershell.exe
1080	powershell.exe
704	powershell.exe
3172	powershell.exe
3508	powershell.exe
3436	powershell.exe
4256	powershell.exe
1568	powershell.exe
3364	powershell.exe
4716	powershell.exe
1108	SppExtComObj.exe
1836	SppExtComObj.exe
1580	SppExtComObj.exe
1116	SppExtComObj.exe
2224	SppExtComObj.exe
3104	SppExtComObj.exe
2780	SppExtComObj.exe
4652	SppExtComObj.exe
5068	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	DllCommonsvc.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	1140	DllCommonsvc.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	1108	SppExtComObj.exe
Token: SeDebugPrivilege	1836	SppExtComObj.exe
Token: SeDebugPrivilege	1580	SppExtComObj.exe
Token: SeDebugPrivilege	1116	SppExtComObj.exe
Token: SeDebugPrivilege	2224	SppExtComObj.exe
Token: SeDebugPrivilege	3104	SppExtComObj.exe
Token: SeDebugPrivilege	2780	SppExtComObj.exe
Token: SeDebugPrivilege	4652	SppExtComObj.exe
Token: SeDebugPrivilege	5068	SppExtComObj.exe
Token: SeDebugPrivilege	3544	SppExtComObj.exe
Token: SeDebugPrivilege	1860	SppExtComObj.exe
Token: SeDebugPrivilege	5072	SppExtComObj.exe
Token: SeDebugPrivilege	1300	SppExtComObj.exe
Token: SeDebugPrivilege	1496	SppExtComObj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2108	3992	JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe	82
PID 3992 wrote to memory of 2108	3992	JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe	82
PID 3992 wrote to memory of 2108	3992	JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe	82
PID 2108 wrote to memory of 4116	2108	WScript.exe	83
PID 2108 wrote to memory of 4116	2108	WScript.exe	83
PID 2108 wrote to memory of 4116	2108	WScript.exe	83
PID 4116 wrote to memory of 3516	4116	cmd.exe	85
PID 4116 wrote to memory of 3516	4116	cmd.exe	85
PID 3516 wrote to memory of 1668	3516	DllCommonsvc.exe	95
PID 3516 wrote to memory of 1668	3516	DllCommonsvc.exe	95
PID 3516 wrote to memory of 4904	3516	DllCommonsvc.exe	96
PID 3516 wrote to memory of 4904	3516	DllCommonsvc.exe	96
PID 3516 wrote to memory of 4972	3516	DllCommonsvc.exe	97
PID 3516 wrote to memory of 4972	3516	DllCommonsvc.exe	97
PID 3516 wrote to memory of 3584	3516	DllCommonsvc.exe	101
PID 3516 wrote to memory of 3584	3516	DllCommonsvc.exe	101
PID 3584 wrote to memory of 2928	3584	cmd.exe	103
PID 3584 wrote to memory of 2928	3584	cmd.exe	103
PID 3584 wrote to memory of 1140	3584	cmd.exe	106
PID 3584 wrote to memory of 1140	3584	cmd.exe	106
PID 1140 wrote to memory of 3172	1140	DllCommonsvc.exe	140
PID 1140 wrote to memory of 3172	1140	DllCommonsvc.exe	140
PID 1140 wrote to memory of 4716	1140	DllCommonsvc.exe	141
PID 1140 wrote to memory of 4716	1140	DllCommonsvc.exe	141
PID 1140 wrote to memory of 1240	1140	DllCommonsvc.exe	142
PID 1140 wrote to memory of 1240	1140	DllCommonsvc.exe	142
PID 1140 wrote to memory of 3436	1140	DllCommonsvc.exe	143
PID 1140 wrote to memory of 3436	1140	DllCommonsvc.exe	143
PID 1140 wrote to memory of 1080	1140	DllCommonsvc.exe	144
PID 1140 wrote to memory of 1080	1140	DllCommonsvc.exe	144
PID 1140 wrote to memory of 4756	1140	DllCommonsvc.exe	145
PID 1140 wrote to memory of 4756	1140	DllCommonsvc.exe	145
PID 1140 wrote to memory of 4256	1140	DllCommonsvc.exe	147
PID 1140 wrote to memory of 4256	1140	DllCommonsvc.exe	147
PID 1140 wrote to memory of 3364	1140	DllCommonsvc.exe	148
PID 1140 wrote to memory of 3364	1140	DllCommonsvc.exe	148
PID 1140 wrote to memory of 4504	1140	DllCommonsvc.exe	149
PID 1140 wrote to memory of 4504	1140	DllCommonsvc.exe	149
PID 1140 wrote to memory of 704	1140	DllCommonsvc.exe	150
PID 1140 wrote to memory of 704	1140	DllCommonsvc.exe	150
PID 1140 wrote to memory of 1568	1140	DllCommonsvc.exe	151
PID 1140 wrote to memory of 1568	1140	DllCommonsvc.exe	151
PID 1140 wrote to memory of 3508	1140	DllCommonsvc.exe	152
PID 1140 wrote to memory of 3508	1140	DllCommonsvc.exe	152
PID 1140 wrote to memory of 4732	1140	DllCommonsvc.exe	164
PID 1140 wrote to memory of 4732	1140	DllCommonsvc.exe	164
PID 4732 wrote to memory of 1820	4732	cmd.exe	166
PID 4732 wrote to memory of 1820	4732	cmd.exe	166
PID 4732 wrote to memory of 1108	4732	cmd.exe	169
PID 4732 wrote to memory of 1108	4732	cmd.exe	169
PID 1108 wrote to memory of 2636	1108	SppExtComObj.exe	170
PID 1108 wrote to memory of 2636	1108	SppExtComObj.exe	170
PID 2636 wrote to memory of 3696	2636	cmd.exe	172
PID 2636 wrote to memory of 3696	2636	cmd.exe	172
PID 2636 wrote to memory of 1836	2636	cmd.exe	173
PID 2636 wrote to memory of 1836	2636	cmd.exe	173
PID 1836 wrote to memory of 1688	1836	SppExtComObj.exe	175
PID 1836 wrote to memory of 1688	1836	SppExtComObj.exe	175
PID 1688 wrote to memory of 3364	1688	cmd.exe	177
PID 1688 wrote to memory of 3364	1688	cmd.exe	177
PID 1688 wrote to memory of 1580	1688	cmd.exe	179
PID 1688 wrote to memory of 1580	1688	cmd.exe	179
PID 1580 wrote to memory of 2740	1580	SppExtComObj.exe	180
PID 1580 wrote to memory of 2740	1580	SppExtComObj.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d859e6e67e8fb880b72b5b99facb0686c0824a666bb148226c520136d35552e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mpIzK15CW6.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3584
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2928
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sihost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0GcnrLyorL.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1820
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3696
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3364
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat"
        13⤵
        
        PID:2740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1576
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat"
        15⤵
        
        PID:312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3412
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat"
        17⤵
        
        PID:4972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4432
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gTQuRhIyam.bat"
        19⤵
        
        PID:4072
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4864
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat"
        21⤵
        
        PID:3036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1108
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat"
        23⤵
        
        PID:3496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2936
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        25⤵
        
        PID:3384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2084
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iPSx7mMsuZ.bat"
        27⤵
        
        PID:3964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4232
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dgWvFyiHB2.bat"
        29⤵
        
        PID:3904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1352
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat"
        31⤵
        
        PID:5024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:1260
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"
        33⤵
        
        PID:1148
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:3488
        
        C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe
        
        "C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\attachments\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\attachments\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\DigitalLocker\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\Visualizations\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2ea91e7d1b473f8290ae52d13e105194

SHA1
5e565d99a7733250427e70f5f6e1951a081deed6

SHA256
712db2b991a3c11ccd71b36cfe99fad0b5b1eb1026b12d28c35a43334128671a

SHA512
0d6e2f0f8963986cb27a5cb853c5a87af5d2b65142ff082b4a12681b467d4a72efbcaea71307513523915aa4f27e7b238c67f4ab563f69525938f38253599424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9405862a3b15dc34824f6a0e5f077f4f

SHA1
bbe0000e06be94fa61d6e223fb38b1289908723d

SHA256
0a0869426bca171c080316948a4638a7152018ea5e07de97b2d51e0d90905210

SHA512
fc7ae988b81dec5b13ae9878350cd9d063538bfb2bc14f099087836ed54cd77a36bc7c4276fa075a80a3cd20e7620fa2ba5a8b5b7bf98698b10752749187148d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be95052f298019b83e11336567f385fc

SHA1
556e6abda268afaeeec5e1ee65adc01660b70534

SHA256
ebc004fe961bed86adc4025cdbe3349699a5a1fc328cc3a37f3ff055e7e82027

SHA512
233df172f37f85d34448901057ff19f20792d6e139579a1235165d5f6056a2075c19c85bc9115a6bb74c9c949aebd7bb5391e2ae9f7b1af69e5c4aca3a48cff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8d9b95fdab142bb52f794b152e9b8230

SHA1
badb1d4568eb62dca12181d0c7fb093779c9a4de

SHA256
b2b0ff5c6f0f0bbe286910bc2424d7b747fce3b7d7609cc6434aea99372aaa39

SHA512
3f05056bdec2e72f1342f45639c5a89aa175a3a4fdb8494dda31b346faf970b10cc0ab322533514d8f5b591e051a2a35595b0448918e25dbbc6cf02854276b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2771ccbcebfa4e683e0f6b1df91fe614

SHA1
41066c98842b6bdfde83e63df35f37a1d7f1199f

SHA256
cf144ae60a055a6256bc6fe206b2c836f21d961a5981b24f8ec97852227695da

SHA512
78fa0cf06ba15a80eea999b572d07af207f5d90008401d204385181593c57893ddce5766604eb0d7590315560096c8c813da1cbf483d77fd5318b6c569d5baa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8609c12c59293ee67562f5096525f6f

SHA1
7b89311e1e00dec0658daa7749b6560af217435c

SHA256
9e7a84df1f437f21ceba6e519fbbd333f0bd7721e8e4b0bb963652fb9a1163fa

SHA512
ce6838f441c0954739ec5e03af0726d20b892c4415df3c3ee2010bc6c8f6191ac6717d0e3499ce04a03441b1ad43fc7a2df0de34a1ebd67fbd62cfdf48007b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\0GcnrLyorL.bat

Filesize
234B

MD5
c5d6ad27d28821c398fa7ec045bf8938

SHA1
ae77d4b7367986ef413482e5c99f3e016a2e5eb0

SHA256
7a0fa574351926adbe677ed255fc3122a5ccdc942e4abfb4d2383bd03171b7b2

SHA512
4c7833492df7b9047a7c3bbf94a028514b99a49100e2096594a24a1f6cda79a147470f2dbd10fe7690f181e131a210b9cdc0bf92a3946a1bcac67f160b5fe7ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\0IgHXqOu0A.bat

Filesize
234B

MD5
fecd8f33be49a80f72ecf6b7e828051b

SHA1
7fb00083918fbf41e76e0c39d906f00730810c5a

SHA256
6187342aeedb1d29d4cec69a9aef750781e9ec5d9056b70e9b9c21eaa1379ac5

SHA512
0194b1bf8a3153ab067f6fe816f6cde3c42fc32f0a5d16b3037e5c19dff6a46224fa49ffdc293718e4a2ca44b154d325bcc99bf0a27521474d6f073a110c7e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat

Filesize
234B

MD5
5466b84441aff0ca4ac706699dd11a2c

SHA1
18673d527372e049a5e604f667c8d5fb71d2caa7

SHA256
22e6031b7690bb10a032006b69259c744d4bb89abfd0f3d5f80814c9658413fe

SHA512
7fbe39d7d7e5fcb2c290994e357604b9cb2f1d5e2203952eeee56dfa560e64b7df30602fb588912173b2069d296ee253f14f8caae343564ce368e39ab18243b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat

Filesize
234B

MD5
0ccfcc72602bfe3a1b7a55fd67a62bca

SHA1
f4bf95f3fd05da381db19c847415fb6356317536

SHA256
0eee2731b143fa757ba31ba6f7fc325204f8928f66770ba52544a3eb33663e57

SHA512
ccdeafa8460b17d29be87289430c47b0a7ecf7807591cd0b043c6a74955749dfb67b995e1c2f77a95aa647d6092cf92264b44b390352ffda63eecf7c03da9681

Download Submit
C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat

Filesize
234B

MD5
c1f0df95f2921c5286a236f052457bdd

SHA1
e1235a26409664f0475543cc05458851f6351b86

SHA256
ca7c4904008e56f78bf3fe9ff607df8b14d946fcf25bde80c2255aef6eea853b

SHA512
e92d55851180de1ce8de33b6eac41519149cef7f7b82ebcea6349d6b6a6a0831089d0dccf475d3fd8ff3437e9dd55248d2088e872048d3fe461d490efaa8727e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat

Filesize
234B

MD5
8914072a0ed007320dcc68d619def201

SHA1
14b7a12990272e5d04943a2b92f1d02ce6ce67d3

SHA256
3df6c2801d85cf20f1ed07b423b2a51320a524bf299c4e6531ae72f83e12436d

SHA512
4603a7f6e21faeecbb61d83874d3227663ca5ee0f94114bee591e07820cb4c6f41fa4fbe6eabc548000bb358c07865cc741fbdf477e611a250b6bb92face66aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat

Filesize
234B

MD5
a6fcc3a46134261dcf5b062bdc76bb4b

SHA1
bd48810cd988b7fee20ab2cc85039e35d7d1e3e9

SHA256
0793f600d99b32da2a684ea36a62e09d14328133484babd77eb387b82be10efe

SHA512
21f3ea4514380bbbc6bab2fa74b62f82ade2d47dbd25b972045e2594ec0609559a8aaaa569eac71e69088017d4d9983a2cf7e3383c20c32684b5c535c51dde22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat

Filesize
234B

MD5
c5de365e30ecc55135d8a33c7631b778

SHA1
c3d2a3f5c11fecfe72e3c7cc2694ce4807569bdd

SHA256
f0e02f0d5deb8eaae9a113c0fdaaf0a8c12e44b17070bf0d33fc5379db2be3f4

SHA512
91de883dc5ca58503254cbd64bfb40219ba8e562277073a552d77244c4343850d9d76970b5c93159bf489ea0b1f384712b73f693e5acebcf19be899f0a23ced4

Download Submit
C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat

Filesize
234B

MD5
de6bb6eaaa66f75a3d403f678c9572e1

SHA1
fddf80acab50fde2d94f8da2bfc0e0c8a7af5754

SHA256
cf1eeab2eb55bbfaa2713a64fa8a9ddbdf52022582e6897ae95dc8c9bdb9e959

SHA512
c2345421db94ce88432c2d271d4a565d9880e4215dcfd05947dbe4f9eb418731512c55284ebca13df2bf09a329b3bc534c6257462b17c7ae0dd45601d62d7043

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1njnyiks.d44.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dgWvFyiHB2.bat

Filesize
234B

MD5
ed5fabc977186ec9445aabb053e8b639

SHA1
b6d46e9930b0a03a050991ba006c0e6affda47e9

SHA256
16e8c82dda140a2ff85583271bbb004017a1851d8c38b3e5656b8e03777ea9e0

SHA512
1f719d97b7e664b0234472ffed3c265638b620024c0d97846b3c267b741d95cb33ff4a91834ae61f7e120a0d252e8a4023f613e64d28d861c94d35e3d3816889

Download Submit
C:\Users\Admin\AppData\Local\Temp\gTQuRhIyam.bat

Filesize
234B

MD5
e3f0ac8b97e28c9a979a14795b88f3a9

SHA1
50d55828510a73804f381fdca9079369264d5657

SHA256
ddd098e87b89b97e47058e08ab91b7a23ce9a2ad147f341d512156b7bd2ade9e

SHA512
55b28eed82b755bea4379937dc72445f784fba0622524e3ea32b94e36a813ed0924e11f9681c521da294706442ff8f43ab4628ba49b81238e4035d74ffb564f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\iPSx7mMsuZ.bat

Filesize
234B

MD5
8172b9ea931046f95618d640c45e47cc

SHA1
139b3dd308df5e4bee99670da0c3b57a7ea0e935

SHA256
0b29a598ab78c80791988441329691d65a13c3bbf9fef0f4a9d881fb99190918

SHA512
4a18bccc7b2fda6f1e17e6c1da6a4e92f79f6a39fcc38ffb3172e756881f9c0c0eb54ca03f3031e467275e6a91d9bc161831efbe7eda55d1f7e4b9764102fe8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat

Filesize
234B

MD5
0978736a64f113ed24e4e956656c10b5

SHA1
8509e6ff13de75a80947d04465fc1ba1451cea16

SHA256
599d4e07bf29f18d2d00e3a0264aaa6c641af97242205074c1aacd7d592462dd

SHA512
e5f4cbdded965e0046167cefa59c5929bec12e59e24b76b976cf06b4b1a63e9bebd3b5e5a6aba99651a1b0c3b7d7dc327a6fe30971b066baaa671076c0f11683

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpIzK15CW6.bat

Filesize
199B

MD5
0b42bf19a6a769627d6b652360aad95c

SHA1
e74f98ddf6b8ed652d64bad407f90488f1259d00

SHA256
ca19d4e9b2a6d98b46fba4e431da2730b70f4724fe1a1498b680357b3b40d670

SHA512
11ce0243d9cfdb9b6924650b042cc52a01fb0d583e640ce036b5ccb1f56d82dd659694698189b71323d44ec3ac136938ce13019b232a4b7d866f235c099c4e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat

Filesize
234B

MD5
09f629f7b1891802acd823328279cf44

SHA1
2139e61090a9db7d3b4c613eeaf235d111299c93

SHA256
77da820eaac30d699fdc276f18b4646f0f95adcc5c3ecc04fa1942ff5d9026b1

SHA512
9aedf61c06479a337079e05c442c3ead8f44982f731fb8560171d7c151d1dcf9947671edb4ac45f49bea8dc2857b257e5988aac9449f1a85e0ed5ea58f02a3cb

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1140-65-0x0000000002D00000-0x0000000002D12000-memory.dmp

Filesize
72KB

Download
memory/1300-304-0x000000001B3E0000-0x000000001B3F2000-memory.dmp

Filesize
72KB

Download
memory/1836-236-0x00000000021E0000-0x00000000021F2000-memory.dmp

Filesize
72KB

Download
memory/3516-12-0x00007FF929E93000-0x00007FF929E95000-memory.dmp

Filesize
8KB

Download
memory/3516-13-0x0000000000FE0000-0x00000000010F0000-memory.dmp

Filesize
1.1MB

Download
memory/3516-14-0x0000000001790000-0x00000000017A2000-memory.dmp

Filesize
72KB

Download
memory/3516-15-0x0000000001980000-0x000000000198C000-memory.dmp

Filesize
48KB

Download
memory/3516-16-0x0000000001950000-0x000000000195C000-memory.dmp

Filesize
48KB

Download
memory/3516-17-0x0000000001970000-0x000000000197C000-memory.dmp

Filesize
48KB

Download
memory/4972-36-0x000001977EAF0000-0x000001977EB12000-memory.dmp

Filesize
136KB

Download
memory/5072-297-0x0000000000D30000-0x0000000000D42000-memory.dmp

Filesize
72KB

Download