dcrat | 05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754

Analysis

max time kernel
146s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe
Size

1.3MB
MD5

62f010ff7900fb61d7869d375b814fc9
SHA1

60b47402c18943cebdd4f0e6948dda080fbf14f9
SHA256

05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754
SHA512

ad35272dc5c66d4e4c6ede9a2375fc85f5abe88cc1ad65d228445fcce5b265aeba765131b33f18bdb531dcd479481a9fc860962565295d62c9c468f687483c92
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2592	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2592	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b94-9.dat	dcrat
behavioral2/memory/4620-13-0x0000000000920000-0x0000000000A30000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3852	powershell.exe
3892	powershell.exe
2804	powershell.exe
4680	powershell.exe
1512	powershell.exe
4760	powershell.exe
384	powershell.exe
4372	powershell.exe
2324	powershell.exe
2556	powershell.exe
448	powershell.exe
3676	powershell.exe
4764	powershell.exe
3620	powershell.exe
2076	powershell.exe
4600	powershell.exe
3412	powershell.exe
4692	powershell.exe
1316	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 15 IoCs

pid	Process
4620	DllCommonsvc.exe
1752	DllCommonsvc.exe
5636	DllCommonsvc.exe
5952	DllCommonsvc.exe
3328	DllCommonsvc.exe
5408	DllCommonsvc.exe
5200	DllCommonsvc.exe
3332	DllCommonsvc.exe
4184	DllCommonsvc.exe
632	DllCommonsvc.exe
5836	DllCommonsvc.exe
5388	DllCommonsvc.exe
1408	DllCommonsvc.exe
3324	DllCommonsvc.exe
2156	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
44	raw.githubusercontent.com
51	raw.githubusercontent.com
53	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
40	raw.githubusercontent.com
42	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
20	raw.githubusercontent.com
21	raw.githubusercontent.com
43	raw.githubusercontent.com
50	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Crashpad\attachments\ea1d8f6d871115	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Skins\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Skins\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\attachments\upfc.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\services.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\TAPI\services.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\Application\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\Application\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\services.exe	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\c5b4cb5e9653cc	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe
2080	schtasks.exe
1864	schtasks.exe
2508	schtasks.exe
2188	schtasks.exe
2960	schtasks.exe
1904	schtasks.exe
3148	schtasks.exe
4688	schtasks.exe
2644	schtasks.exe
1936	schtasks.exe
4052	schtasks.exe
2940	schtasks.exe
3044	schtasks.exe
3348	schtasks.exe
4420	schtasks.exe
1452	schtasks.exe
2008	schtasks.exe
4956	schtasks.exe
2388	schtasks.exe
1912	schtasks.exe
1224	schtasks.exe
4784	schtasks.exe
864	schtasks.exe
5032	schtasks.exe
4884	schtasks.exe
3048	schtasks.exe
4404	schtasks.exe
1336	schtasks.exe
2688	schtasks.exe
5004	schtasks.exe
3224	schtasks.exe
2156	schtasks.exe
4236	schtasks.exe
2236	schtasks.exe
452	schtasks.exe
2608	schtasks.exe
2424	schtasks.exe
4668	schtasks.exe
4456	schtasks.exe
3356	schtasks.exe
1700	schtasks.exe
4824	schtasks.exe
1968	schtasks.exe
3728	schtasks.exe
816	schtasks.exe
2616	schtasks.exe
3032	schtasks.exe
3328	schtasks.exe
3804	schtasks.exe
32	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	DllCommonsvc.exe
4620	DllCommonsvc.exe
4620	DllCommonsvc.exe
4620	DllCommonsvc.exe
4620	DllCommonsvc.exe
1512	powershell.exe
1512	powershell.exe
2556	powershell.exe
2324	powershell.exe
2556	powershell.exe
2324	powershell.exe
1752	DllCommonsvc.exe
1752	DllCommonsvc.exe
1752	DllCommonsvc.exe
4692	powershell.exe
4692	powershell.exe
4760	powershell.exe
4760	powershell.exe
384	powershell.exe
384	powershell.exe
3412	powershell.exe
3412	powershell.exe
3852	powershell.exe
3852	powershell.exe
2804	powershell.exe
4372	powershell.exe
4372	powershell.exe
2804	powershell.exe
1316	powershell.exe
1316	powershell.exe
2076	powershell.exe
2076	powershell.exe
4600	powershell.exe
4600	powershell.exe
3676	powershell.exe
3676	powershell.exe
4680	powershell.exe
4680	powershell.exe
3892	powershell.exe
3892	powershell.exe
3620	powershell.exe
3620	powershell.exe
448	powershell.exe
448	powershell.exe
3676	powershell.exe
4764	powershell.exe
4764	powershell.exe
3412	powershell.exe
4764	powershell.exe
4692	powershell.exe
4692	powershell.exe
4760	powershell.exe
384	powershell.exe
4760	powershell.exe
384	powershell.exe
4680	powershell.exe
3852	powershell.exe
2804	powershell.exe
3892	powershell.exe
3620	powershell.exe
4600	powershell.exe
1316	powershell.exe
2076	powershell.exe
448	powershell.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	DllCommonsvc.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1752	DllCommonsvc.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	5636	DllCommonsvc.exe
Token: SeDebugPrivilege	5952	DllCommonsvc.exe
Token: SeDebugPrivilege	3328	DllCommonsvc.exe
Token: SeDebugPrivilege	5408	DllCommonsvc.exe
Token: SeDebugPrivilege	5200	DllCommonsvc.exe
Token: SeDebugPrivilege	3332	DllCommonsvc.exe
Token: SeDebugPrivilege	4184	DllCommonsvc.exe
Token: SeDebugPrivilege	632	DllCommonsvc.exe
Token: SeDebugPrivilege	5836	DllCommonsvc.exe
Token: SeDebugPrivilege	5388	DllCommonsvc.exe
Token: SeDebugPrivilege	1408	DllCommonsvc.exe
Token: SeDebugPrivilege	3324	DllCommonsvc.exe
Token: SeDebugPrivilege	2156	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3596	4768	JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe	83
PID 4768 wrote to memory of 3596	4768	JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe	83
PID 4768 wrote to memory of 3596	4768	JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe	83
PID 3596 wrote to memory of 2072	3596	WScript.exe	85
PID 3596 wrote to memory of 2072	3596	WScript.exe	85
PID 3596 wrote to memory of 2072	3596	WScript.exe	85
PID 2072 wrote to memory of 4620	2072	cmd.exe	87
PID 2072 wrote to memory of 4620	2072	cmd.exe	87
PID 4620 wrote to memory of 2324	4620	DllCommonsvc.exe	96
PID 4620 wrote to memory of 2324	4620	DllCommonsvc.exe	96
PID 4620 wrote to memory of 2556	4620	DllCommonsvc.exe	97
PID 4620 wrote to memory of 2556	4620	DllCommonsvc.exe	97
PID 4620 wrote to memory of 1512	4620	DllCommonsvc.exe	98
PID 4620 wrote to memory of 1512	4620	DllCommonsvc.exe	98
PID 4620 wrote to memory of 2308	4620	DllCommonsvc.exe	102
PID 4620 wrote to memory of 2308	4620	DllCommonsvc.exe	102
PID 2308 wrote to memory of 932	2308	cmd.exe	104
PID 2308 wrote to memory of 932	2308	cmd.exe	104
PID 2308 wrote to memory of 1752	2308	cmd.exe	112
PID 2308 wrote to memory of 1752	2308	cmd.exe	112
PID 1752 wrote to memory of 4760	1752	DllCommonsvc.exe	158
PID 1752 wrote to memory of 4760	1752	DllCommonsvc.exe	158
PID 1752 wrote to memory of 384	1752	DllCommonsvc.exe	159
PID 1752 wrote to memory of 384	1752	DllCommonsvc.exe	159
PID 1752 wrote to memory of 4680	1752	DllCommonsvc.exe	160
PID 1752 wrote to memory of 4680	1752	DllCommonsvc.exe	160
PID 1752 wrote to memory of 2076	1752	DllCommonsvc.exe	161
PID 1752 wrote to memory of 2076	1752	DllCommonsvc.exe	161
PID 1752 wrote to memory of 3620	1752	DllCommonsvc.exe	162
PID 1752 wrote to memory of 3620	1752	DllCommonsvc.exe	162
PID 1752 wrote to memory of 3852	1752	DllCommonsvc.exe	164
PID 1752 wrote to memory of 3852	1752	DllCommonsvc.exe	164
PID 1752 wrote to memory of 4764	1752	DllCommonsvc.exe	165
PID 1752 wrote to memory of 4764	1752	DllCommonsvc.exe	165
PID 1752 wrote to memory of 3676	1752	DllCommonsvc.exe	166
PID 1752 wrote to memory of 3676	1752	DllCommonsvc.exe	166
PID 1752 wrote to memory of 4692	1752	DllCommonsvc.exe	167
PID 1752 wrote to memory of 4692	1752	DllCommonsvc.exe	167
PID 1752 wrote to memory of 2804	1752	DllCommonsvc.exe	168
PID 1752 wrote to memory of 2804	1752	DllCommonsvc.exe	168
PID 1752 wrote to memory of 4372	1752	DllCommonsvc.exe	169
PID 1752 wrote to memory of 4372	1752	DllCommonsvc.exe	169
PID 1752 wrote to memory of 1316	1752	DllCommonsvc.exe	170
PID 1752 wrote to memory of 1316	1752	DllCommonsvc.exe	170
PID 1752 wrote to memory of 3892	1752	DllCommonsvc.exe	172
PID 1752 wrote to memory of 3892	1752	DllCommonsvc.exe	172
PID 1752 wrote to memory of 3412	1752	DllCommonsvc.exe	173
PID 1752 wrote to memory of 3412	1752	DllCommonsvc.exe	173
PID 1752 wrote to memory of 448	1752	DllCommonsvc.exe	174
PID 1752 wrote to memory of 448	1752	DllCommonsvc.exe	174
PID 1752 wrote to memory of 4600	1752	DllCommonsvc.exe	176
PID 1752 wrote to memory of 4600	1752	DllCommonsvc.exe	176
PID 1752 wrote to memory of 752	1752	DllCommonsvc.exe	190
PID 1752 wrote to memory of 752	1752	DllCommonsvc.exe	190
PID 752 wrote to memory of 3752	752	cmd.exe	192
PID 752 wrote to memory of 3752	752	cmd.exe	192
PID 752 wrote to memory of 5636	752	cmd.exe	197
PID 752 wrote to memory of 5636	752	cmd.exe	197
PID 5636 wrote to memory of 5824	5636	DllCommonsvc.exe	199
PID 5636 wrote to memory of 5824	5636	DllCommonsvc.exe	199
PID 5824 wrote to memory of 5884	5824	cmd.exe	201
PID 5824 wrote to memory of 5884	5824	cmd.exe	201
PID 5824 wrote to memory of 5952	5824	cmd.exe	203
PID 5824 wrote to memory of 5952	5824	cmd.exe	203

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05d935d0859885620b53a8e3d8d8c24b690d4918a15c652fb7500e62bde02754.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\akuRJNtHqH.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:932
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\StartMenuExperienceHost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\Application\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Skins\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\upfc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\Saved Pictures\SearchApp.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w5JGmeKVyo.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3752
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5884
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RFyBjogktz.bat"
        11⤵
        
        PID:3704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5076
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2sHl3bGdB9.bat"
        13⤵
        
        PID:4792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4056
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat"
        15⤵
        
        PID:4776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3564
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat"
        17⤵
        
        PID:2976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3604
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat"
        19⤵
        
        PID:3988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4372
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat"
        21⤵
        
        PID:5516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3536
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat"
        23⤵
        
        PID:5704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:5932
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat"
        25⤵
        
        PID:5368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1516
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat"
        27⤵
        
        PID:3256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4764
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat"
        29⤵
        
        PID:4532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4948
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat"
        31⤵
        
        PID:3428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:4496
        
        C:\Recovery\WindowsRE\DllCommonsvc.exe
        
        "C:\Recovery\WindowsRE\DllCommonsvc.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\TAPI\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Vss\Writers\Application\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\Writers\Application\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\Skins\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Skins\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Crashpad\attachments\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Crashpad\attachments\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\Writers\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Saved Pictures\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Pictures\Saved Pictures\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ca5f066b9f9fe5524bc68022defc0152

SHA1
36002bf06b2e5d6e2e0e19d3d7274f11e0c5cec2

SHA256
2020884668619f82b26cf38f827e154af76652f36ba1ddd41a6b93eb585d4f43

SHA512
a39310d4e931f133be3f894c50bf557b229adf9fbd9e0cefd47a072a7fbe2aeb1b593fb37e3d699b1c45d06ef62a6e02d39e383701e9936a95bf9968a747388f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f6a77860cd9c5289dd6e45bbc36a982

SHA1
750d55b0d394bc5716fc3e3204975b029d3dc43b

SHA256
a8388051b43fdc7a50ee51047ef4076c4b6502a6e53befe8131efcb71aa700a4

SHA512
e4e4473383243a71d7bebffb8bf4bf449201e1aee752426044e81bdc12c3aaf284ce003a859b0ac96d5fd75063376485dc5b5ac0caad189577bf394f104cdd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
816d03b14553d8d2cd19771bf135873f

SHA1
3efdd566ca724299705e7c30d4cbb84349b7a1ae

SHA256
70d3acdba0037de3d175aca44a86daf8392b2350f6f8b026b7accb02f95a9304

SHA512
365ac792e05619e5ef42b40f1e4dd5d1ebb18a5a409be9c5428e52be7896f4b18eef2a93a4e0f5e1930996bf70798fe45fc5b6d829687d975191015944dbbdbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1d45939ab2a23c517e15ab27071928d5

SHA1
cca448b53ac101e2e71b8a596758b40e126a46cd

SHA256
daa8bffbb709010db0f5344c545413128dec7f689eb4eea35eadb5745572043b

SHA512
1a42dab2ed11144a54bb3cbd93fc40bc6fa6bd347c999b161e633750458adf769e852718a0de23dd89823ac21d155ec20fbe05154c47340c0e70bc1a8a3a2697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
08526e4d8fed0a382c243c9aa8b1fe45

SHA1
f3da4b97529aaa38230db8bfa34a345bbc211622

SHA256
b5044625d66b7835745c7c4efa14d21aaf4ee42bf971f8bbc44f04416b91441f

SHA512
cbeb569db60eabd89c13b073f1bdf7ba991b6206e75f548396a150b08a0ffed1962d88d664e069c64ac740afbb69941df2f43e81a3f138e2185934967898941d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5772860e80a4ad209b363a064b3303d7

SHA1
18da8f9946606bb785740c6f9e24daff3e137d68

SHA256
5e889679e1805fcfacb6971b12ea331d38a58a703f2374fe1eef19f2917d8022

SHA512
207bc482178667f072617c35a84593c0d7e7cbaceed9e93e3365039f043e5f9548f65bf90e51b2dc3735ad0572a90a4271465c653a69498bbb62e472a8d85bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c249d1546fa74aeda0e13ad7d0dc2815

SHA1
3fc3ae47b0d7fa3a2acb9347cb94e70c89c2467d

SHA256
9d30870071199e5fd2f9b6c73cec8ac9fe1503c3d60dbcb5591b775e9d166414

SHA512
2eb90f4da8fa278eaf6f46c13fd2477af3ea428d688049a45643c1c047203adee2389e42943b327f52b808cf7cac583f70ffef20f827908d59fc30af97ffc988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5ccdfe8b7781c09ed55a9fb496c802f2

SHA1
a5b6103034b5b890a70072646328f43d46a40789

SHA256
6037f5b95e40ad628388e11e6b3a499d714a3c43db62672a9d0cd088704c76d4

SHA512
d5153e0b15e1ccb6543e66b50d9306743dd9c31b22332ca78c6b533d9365eb893f2c9b8028c9ba22411287b414e44c09a5b14769830611d764484af24d81a3c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2sHl3bGdB9.bat

Filesize
203B

MD5
1ef0310d3666bc9c0f07ec3614d6a4ec

SHA1
7382fc4fddce123d506f2c7dc66fceedb2909af4

SHA256
bcef7834c34a2ba43e78867eb38f3e3b93f7557de60d9b97faf3fb6fabacec21

SHA512
df81b3c3f77adc3ff039807f7318c054f476a52c2fc57f18bf53094b7e25f8516f23c2b5c067415394166a6518b0126fc3c62e506b5de9e551618ce904854f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat

Filesize
203B

MD5
f5a664c251fb30db1dda5113857867d4

SHA1
e6f85b06ce5a72383dfe86f5562649cde0e557d0

SHA256
7427608c0e416bfc2d310bd6493635a9674640e5d5b95a78cea41f09a8faf248

SHA512
24157d184189e4dca6c6c21da6e9a95587c8f60c59dafbed8e4a8cf1c8cf12ae35ede173f19f52df3c95d113a503ffbf62c4349001bee72a04c651790ae9883e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat

Filesize
203B

MD5
8655ff2592f6320a13d9d0ce5d289932

SHA1
7c670241eee2ff8fe55a26cc22c3017d5f1701af

SHA256
58a09592a4d3bf032a638bf6570a338b5954e212429f1e9ae2dc3e37a7aae8fb

SHA512
8b196a37af4002c77f3d6433a86cddb2d5876706374c1805f685eb4f5c113c029599125985244e13b67fe8914f1b08ece0299c3fdcc70764bababc902c13b336

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat

Filesize
203B

MD5
3b72a59546b6c054752bf9c318f6fbc6

SHA1
af6bbdc799abeaa688e2cb42008fc88464cbc5c2

SHA256
85c2dbf02b52cc95b350abeda094c16c5683e833515eb370c0dc363e49dd66c9

SHA512
d4cf4c05ec3e00c67b6f9d93697d0f37bc847fce5f88232185adee0d57ee3365d9c6335544aafb35006f410f8fffbee9523349d3d9370914157b11352be8cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat

Filesize
203B

MD5
cfdc56c760e4cbc33cd34755c0685ab9

SHA1
c0477185fc355f8ef831b3b72b81a6a7d766fc28

SHA256
20a1e59308829a499ff74665ace89ca43ccc0edc5d84c2035002a15c9c538c8c

SHA512
998874c574162753f12e547970d05146fdf0b7ada67c96292c7287c8ed9fc2135eb483baf3e694440e9de02fafb32c6b969ad781fd0be3f5bf8ecd8810870999

Download Submit
C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat

Filesize
203B

MD5
c792c484b67050541246b7ad2e8632d6

SHA1
754877233463b738ca01fc9ba9892349aed1176c

SHA256
44f571bf868589423d359fcaa12d8f25e84cb9298f4080ce061b4e0c980709ef

SHA512
b95277025daa95c5669999f1e34f1366fc0ff088581fb32c84535163d723ed64ec17b1621509c99dc970ecc0239ab9c49ff97ca413a56efcea5910bf94b3b1c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RFyBjogktz.bat

Filesize
203B

MD5
4fdd7fe24bb48937515fb54b7c01c1a6

SHA1
2be2b09283886430b1e7537cf7480d271ffd2d42

SHA256
43bdd0cc302cec34d48f25395e3c7f1f06c22e570ae127f0c9fdcc5e930c5bef

SHA512
0f3bc87824ab17613b78f848772ec58fa8d9533dc466d76291b7d606b3aba5f7391e2b987d5527e502cdee63ef3a8b29c2c90be081e783c17ba169e5c4942366

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mxk5kcy5.n05.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat

Filesize
203B

MD5
8b2208f1ba2a515132034020fd943386

SHA1
4de7f5c6ba570bbaa4803d3d09d435a54eac82ba

SHA256
c82bfd2682b9f2ce3a19b3bea1dc65872b449755ba540b86bce51764cb348baa

SHA512
9c42dfd46f013de9386eb1097eae4033c6ca4f9f4d1e1fd6817687e583dfbfcd033032d9d1acf9de9d474105aa43662ab669c6b3f90da384e30e2a277ed759ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\akuRJNtHqH.bat

Filesize
199B

MD5
389921cea0df61cd0bbcfc26b6480cc9

SHA1
41897a5e8201e3983d29650b3ce1864bae097ae7

SHA256
19b37e9e4ba996a855edda81d16d50c31f051b845aa040987ff038cafee8c1f9

SHA512
53eca1f5c7149d9aa96cc5788e57b6a80474ffa2483a32c3c887d9963a1a3d8157e33c146a0d8b4196c551f86660141e6341bd19dcbf52570280fd181cb4162d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat

Filesize
203B

MD5
3b3eb9e4bceed4d56ab8db141586bb93

SHA1
7e49e420d402b5c37b9f710de76cd795230ac729

SHA256
fa02b3f778d8c34afe268601ba48599495d533dc2d0e791940b0393956608f83

SHA512
480205c4843e1d3d2507b4cd0cce8b82d798ade3638e0459d30833d2b49b3311251925bf9635ff925e9fe60c5dbfedf946c3a4726efcc72b98cbefc82e226d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat

Filesize
203B

MD5
19310ada960e89561dd9e51d4efc7fff

SHA1
0e0681f1a0faacfbe42ff20e761295ac851e47fe

SHA256
f0190046ebf222b5d11b1da3574eb7b064d8a3e5e2deced8f95af6562fc2743b

SHA512
5c78eea9287e91921f45946f512e37df1e89310d630bbd5e755a24aa240a6cf5c29875db79a169ca34b4f4e750146e658c20892e5bfb8613b110435ff0e8f003

Download Submit
C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat

Filesize
203B

MD5
1c94bcb5b6e3b779a9df6701b6242ef3

SHA1
f9b4b399e25c6d36b2d7f794dbd94d82fd227bc7

SHA256
b792d61b5bb56ecb0e3f58d2c1ed4b7fac789fe4638d8f72d4bc79e78e810d94

SHA512
65ea28a2e78f290d39271f631a0d047a2e3ef42ed0f591c43910af70ad8f0780d234d1e0e700fbdac6168fb890a1e860b8f7e0ca1dea398ad43d11f624cf429d

Download Submit
C:\Users\Admin\AppData\Local\Temp\w5JGmeKVyo.bat

Filesize
203B

MD5
4c4f8999b3922d1a32a677aeaf2d3682

SHA1
ec8bcc9438521af18bc6c8fd374c7e2cfeb026ee

SHA256
610bd624bfefccef690ca85ae7e1fcdbd7414fd3d3faf44ac5f3232efdbe29a4

SHA512
a6a4809f93b4c028d168cf4490beaf4552e18c902eb43aa766bbb716b7a3316d02daa63973713dec610c337f488edaef346358368337631065d9b7cbc7db7df6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/632-323-0x0000000002AF0000-0x0000000002B02000-memory.dmp

Filesize
72KB

Download
memory/1408-343-0x00000000023A0000-0x00000000023B2000-memory.dmp

Filesize
72KB

Download
memory/1512-29-0x00000256C11F0000-0x00000256C1212000-memory.dmp

Filesize
136KB

Download
memory/3324-350-0x0000000001520000-0x0000000001532000-memory.dmp

Filesize
72KB

Download
memory/4620-17-0x000000001BD70000-0x000000001BD7C000-memory.dmp

Filesize
48KB

Download
memory/4620-16-0x000000001B540000-0x000000001B54C000-memory.dmp

Filesize
48KB

Download
memory/4620-15-0x000000001B550000-0x000000001B55C000-memory.dmp

Filesize
48KB

Download
memory/4620-14-0x000000001B530000-0x000000001B542000-memory.dmp

Filesize
72KB

Download
memory/4620-13-0x0000000000920000-0x0000000000A30000-memory.dmp

Filesize
1.1MB

Download
memory/4620-12-0x00007FFCA0CE3000-0x00007FFCA0CE5000-memory.dmp

Filesize
8KB

Download
memory/5200-304-0x0000000000F90000-0x0000000000FA2000-memory.dmp

Filesize
72KB

Download
memory/5388-336-0x0000000000800000-0x0000000000812000-memory.dmp

Filesize
72KB

Download
memory/5408-297-0x0000000001820000-0x0000000001832000-memory.dmp

Filesize
72KB

Download