dcrat | 5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc

Analysis

max time kernel
143s
max time network
139s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe
Size

1.3MB
MD5

e8a95af702557a9df0835578eced102a
SHA1

efccb2c7ad057cb37e03ada28be65254eaa02ea5
SHA256

5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc
SHA512

3c378a8a6a60e0e4d52652c3623de9f69cf41d0bf4746bb995bdaa5228657effb48dd088b090d9a11cf2d84d274aa27553fcba0710586e6ff28400a437c0ed43
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	1808	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1808	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000019cba-9.dat	dcrat
behavioral1/memory/2836-13-0x0000000001270000-0x0000000001380000-memory.dmp	dcrat
behavioral1/memory/1684-133-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/2448-269-0x0000000001070000-0x0000000001180000-memory.dmp	dcrat
behavioral1/memory/2808-389-0x00000000003C0000-0x00000000004D0000-memory.dmp	dcrat
behavioral1/memory/2908-449-0x0000000001010000-0x0000000001120000-memory.dmp	dcrat
behavioral1/memory/2072-569-0x00000000013D0000-0x00000000014E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1800	powershell.exe
2596	powershell.exe
1108	powershell.exe
1676	powershell.exe
2456	powershell.exe
2152	powershell.exe
692	powershell.exe
1100	powershell.exe
1516	powershell.exe
816	powershell.exe
572	powershell.exe
2304	powershell.exe
2460	powershell.exe
1312	powershell.exe
1652	powershell.exe
2584	powershell.exe
1216	powershell.exe
2624	powershell.exe
1032	powershell.exe
1864	powershell.exe
2556	powershell.exe
2676	powershell.exe
3056	powershell.exe
1680	powershell.exe
1328	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2836	DllCommonsvc.exe
2080	DllCommonsvc.exe
1684	Idle.exe
2448	Idle.exe
1332	Idle.exe
2808	Idle.exe
2908	Idle.exe
1472	Idle.exe
2072	Idle.exe
2572	Idle.exe
1556	Idle.exe
2888	Idle.exe
2684	Idle.exe

Loads dropped DLL 2 IoCs

pid	Process
2916	cmd.exe
2916	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
23	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\f3b6ecef712a24	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\24dbde2999530e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
320	schtasks.exe
3024	schtasks.exe
3028	schtasks.exe
2588	schtasks.exe
2284	schtasks.exe
2132	schtasks.exe
2836	schtasks.exe
1712	schtasks.exe
2432	schtasks.exe
2908	schtasks.exe
2252	schtasks.exe
2444	schtasks.exe
1812	schtasks.exe
2040	schtasks.exe
956	schtasks.exe
2220	schtasks.exe
2740	schtasks.exe
2760	schtasks.exe
2756	schtasks.exe
2340	schtasks.exe
884	schtasks.exe
2308	schtasks.exe
2696	schtasks.exe
2056	schtasks.exe
2144	schtasks.exe
2744	schtasks.exe
2244	schtasks.exe
1708	schtasks.exe
1648	schtasks.exe
2020	schtasks.exe
1032	schtasks.exe
1156	schtasks.exe
1944	schtasks.exe
2980	schtasks.exe
1744	schtasks.exe
1860	schtasks.exe
2660	schtasks.exe
1528	schtasks.exe
2812	schtasks.exe
2916	schtasks.exe
1416	schtasks.exe
2796	schtasks.exe
2016	schtasks.exe
2060	schtasks.exe
848	schtasks.exe
2372	schtasks.exe
2704	schtasks.exe
2740	schtasks.exe
956	schtasks.exe
2808	schtasks.exe
2348	schtasks.exe
2392	schtasks.exe
2024	schtasks.exe
3060	schtasks.exe
2276	schtasks.exe
2396	schtasks.exe
1068	schtasks.exe
2556	schtasks.exe
2304	schtasks.exe
2884	schtasks.exe
2332	schtasks.exe
1520	schtasks.exe
2908	schtasks.exe
1108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2836	DllCommonsvc.exe
2836	DllCommonsvc.exe
2836	DllCommonsvc.exe
1108	powershell.exe
572	powershell.exe
816	powershell.exe
2676	powershell.exe
1312	powershell.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
1676	powershell.exe
2584	powershell.exe
1652	powershell.exe
1680	powershell.exe
1032	powershell.exe
2556	powershell.exe
2460	powershell.exe
1800	powershell.exe
692	powershell.exe
1100	powershell.exe
1328	powershell.exe
1684	Idle.exe
2596	powershell.exe
3056	powershell.exe
1864	powershell.exe
1516	powershell.exe
2624	powershell.exe
2456	powershell.exe
1216	powershell.exe
2304	powershell.exe
2152	powershell.exe
2448	Idle.exe
1332	Idle.exe
2808	Idle.exe
2908	Idle.exe
1472	Idle.exe
2072	Idle.exe
2572	Idle.exe
1556	Idle.exe
2888	Idle.exe
2684	Idle.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	DllCommonsvc.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	2080	DllCommonsvc.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	1684	Idle.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2448	Idle.exe
Token: SeDebugPrivilege	1332	Idle.exe
Token: SeDebugPrivilege	2808	Idle.exe
Token: SeDebugPrivilege	2908	Idle.exe
Token: SeDebugPrivilege	1472	Idle.exe
Token: SeDebugPrivilege	2072	Idle.exe
Token: SeDebugPrivilege	2572	Idle.exe
Token: SeDebugPrivilege	1556	Idle.exe
Token: SeDebugPrivilege	2888	Idle.exe
Token: SeDebugPrivilege	2684	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2784	2308	JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe	30
PID 2308 wrote to memory of 2784	2308	JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe	30
PID 2308 wrote to memory of 2784	2308	JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe	30
PID 2308 wrote to memory of 2784	2308	JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe	30
PID 2784 wrote to memory of 2916	2784	WScript.exe	31
PID 2784 wrote to memory of 2916	2784	WScript.exe	31
PID 2784 wrote to memory of 2916	2784	WScript.exe	31
PID 2784 wrote to memory of 2916	2784	WScript.exe	31
PID 2916 wrote to memory of 2836	2916	cmd.exe	33
PID 2916 wrote to memory of 2836	2916	cmd.exe	33
PID 2916 wrote to memory of 2836	2916	cmd.exe	33
PID 2916 wrote to memory of 2836	2916	cmd.exe	33
PID 2836 wrote to memory of 1312	2836	DllCommonsvc.exe	47
PID 2836 wrote to memory of 1312	2836	DllCommonsvc.exe	47
PID 2836 wrote to memory of 1312	2836	DllCommonsvc.exe	47
PID 2836 wrote to memory of 1108	2836	DllCommonsvc.exe	48
PID 2836 wrote to memory of 1108	2836	DllCommonsvc.exe	48
PID 2836 wrote to memory of 1108	2836	DllCommonsvc.exe	48
PID 2836 wrote to memory of 816	2836	DllCommonsvc.exe	49
PID 2836 wrote to memory of 816	2836	DllCommonsvc.exe	49
PID 2836 wrote to memory of 816	2836	DllCommonsvc.exe	49
PID 2836 wrote to memory of 572	2836	DllCommonsvc.exe	50
PID 2836 wrote to memory of 572	2836	DllCommonsvc.exe	50
PID 2836 wrote to memory of 572	2836	DllCommonsvc.exe	50
PID 2836 wrote to memory of 2676	2836	DllCommonsvc.exe	52
PID 2836 wrote to memory of 2676	2836	DllCommonsvc.exe	52
PID 2836 wrote to memory of 2676	2836	DllCommonsvc.exe	52
PID 2836 wrote to memory of 1748	2836	DllCommonsvc.exe	57
PID 2836 wrote to memory of 1748	2836	DllCommonsvc.exe	57
PID 2836 wrote to memory of 1748	2836	DllCommonsvc.exe	57
PID 1748 wrote to memory of 2128	1748	cmd.exe	59
PID 1748 wrote to memory of 2128	1748	cmd.exe	59
PID 1748 wrote to memory of 2128	1748	cmd.exe	59
PID 1748 wrote to memory of 2080	1748	cmd.exe	61
PID 1748 wrote to memory of 2080	1748	cmd.exe	61
PID 1748 wrote to memory of 2080	1748	cmd.exe	61
PID 2080 wrote to memory of 3056	2080	DllCommonsvc.exe	119
PID 2080 wrote to memory of 3056	2080	DllCommonsvc.exe	119
PID 2080 wrote to memory of 3056	2080	DllCommonsvc.exe	119
PID 2080 wrote to memory of 1328	2080	DllCommonsvc.exe	120
PID 2080 wrote to memory of 1328	2080	DllCommonsvc.exe	120
PID 2080 wrote to memory of 1328	2080	DllCommonsvc.exe	120
PID 2080 wrote to memory of 1676	2080	DllCommonsvc.exe	121
PID 2080 wrote to memory of 1676	2080	DllCommonsvc.exe	121
PID 2080 wrote to memory of 1676	2080	DllCommonsvc.exe	121
PID 2080 wrote to memory of 1680	2080	DllCommonsvc.exe	122
PID 2080 wrote to memory of 1680	2080	DllCommonsvc.exe	122
PID 2080 wrote to memory of 1680	2080	DllCommonsvc.exe	122
PID 2080 wrote to memory of 2584	2080	DllCommonsvc.exe	124
PID 2080 wrote to memory of 2584	2080	DllCommonsvc.exe	124
PID 2080 wrote to memory of 2584	2080	DllCommonsvc.exe	124
PID 2080 wrote to memory of 2556	2080	DllCommonsvc.exe	125
PID 2080 wrote to memory of 2556	2080	DllCommonsvc.exe	125
PID 2080 wrote to memory of 2556	2080	DllCommonsvc.exe	125
PID 2080 wrote to memory of 1652	2080	DllCommonsvc.exe	127
PID 2080 wrote to memory of 1652	2080	DllCommonsvc.exe	127
PID 2080 wrote to memory of 1652	2080	DllCommonsvc.exe	127
PID 2080 wrote to memory of 2456	2080	DllCommonsvc.exe	128
PID 2080 wrote to memory of 2456	2080	DllCommonsvc.exe	128
PID 2080 wrote to memory of 2456	2080	DllCommonsvc.exe	128
PID 2080 wrote to memory of 1864	2080	DllCommonsvc.exe	129
PID 2080 wrote to memory of 1864	2080	DllCommonsvc.exe	129
PID 2080 wrote to memory of 1864	2080	DllCommonsvc.exe	129
PID 2080 wrote to memory of 1032	2080	DllCommonsvc.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f0f68fb850fe1e05ab889d4268bf8856e7296286becb575c5a61686da29b3dc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjLuxY44un.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2128
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\OSPPSVC.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\winlogon.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\winlogon.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"
        8⤵
        
        PID:2692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1036
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat"
        10⤵
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2188
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat"
        12⤵
        
        PID:2228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:320
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"
        14⤵
        
        PID:2912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2132
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat"
        16⤵
        
        PID:920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1696
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat"
        18⤵
        
        PID:2272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2988
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S2GQUB77UU.bat"
        20⤵
        
        PID:1488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2080
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat"
        22⤵
        
        PID:2096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2204
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat"
        24⤵
        
        PID:2628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2252
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"
        26⤵
        
        PID:2248
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:884
        
        C:\Users\Public\Pictures\Sample Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Sample Pictures\Idle.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Desktop\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Desktop\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Sample Pictures\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\Sample Pictures\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\My Documents\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\My Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\My Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Services\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\DllCommonsvc.exe'" /f
1⤵
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9112f59fea559b6f5fc6d0bfe935ff85

SHA1
3f774963f4604419795e2b3bb3b2ad76c12c4b57

SHA256
ca4187c1f029b735ca62e9e322ef19bf7cf34cea11925e6dcffd5aa07fe6612e

SHA512
70df9ae7603ce24df74e3fa29c1dd95e6b07cc9676ecd8bb932e5c0fe3029c4b6763b30ac2f561b75af71182c39735e24e07d3bb70e445f3bd55c75aca3c48e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36a37016302561b780de2a8429f2872e

SHA1
d777aea6014c82474a135c536e92a9c5fb6edc28

SHA256
fd19d6da747d49b64086f8b9940e68a4d39689f8caffc3453db673e1c6b40e23

SHA512
154e6d919d1423740f9e2de7eb47a6b5f77896080ede3c4640679a1dccf97e3405606b49fdd6dbab287c614475bf23ce70586a5a29aa876ab21806212d0d72aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e061ec6344e3985086c246b40fd0d4b5

SHA1
6ef2bd341d18e61584a6d8ef476e4bd2b7223633

SHA256
86c62eb93ed13fc6eb236864961a3dcbe319a6ef810ca49daef946135bbd33aa

SHA512
5b33a342f017fa8630bb1b7ea399b1b8d9fca5007190c6ab462201201375bb06858218413978bcd611894525dff97f1ecf69e973bb46fde7ac9fe1060d877ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ca72a357a2b19cf7d0733d47342c224

SHA1
0753a49ddfaa6d988ebbd54d9596377a79bdd61c

SHA256
563b53e56a51fe5d44e9ced4b88fd66ce68898a30f31014dff8c1270aa9ef455

SHA512
2b2e065c96ec9b72aba4ec286b0e3965b90ffe895516965a78dd90faa476b0928dccc7ec31440cf64ecbafc7e09805baa58f4a5e3e035dd5de12189c3e806b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a62085d303a18387e2ec722f5193dc70

SHA1
85e9615c8e81d6722ceb1f52d9e56bb31305d84f

SHA256
576821c4f4f3e5ae97c4eac35d9fa2c3726080607b8813641ef20410aadf72d9

SHA512
c88317f1989359adfd189cc62cf3a355e9dcfdb589679d67912bf88ff1a49c613b8f5a25b8b902c0069e95129d7a536680aec62ce3955d0b9f7d89bbcfa83709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed55da8ca9dd399e21c1b4ce9d6573d5

SHA1
0beabfc039a22f9d0f85dadec2d18981773f7905

SHA256
fe051827a7faf55fd7adaa21ebc854f2e4c0f1e614ace9d8b68155dbbba42ac4

SHA512
b9410cc4fa3f332ee6e39e189337bcbc1702fb9115a6719ada9c1cdb78f0894047d47280ba5595df2d34e0fab2e7e58fc230c9da4420409d24d2a8e54087fc85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6bec806ee0c60615dff080cc6987da1

SHA1
d6ff45a23d5e6f5e0675de48780de49b34653c57

SHA256
3453a611acb04a796fd73b6fd43e30765c761b384c9d9645602dcc61682e965a

SHA512
c384e0677ca2deb507dbeccb8ce71860e05b8348cd8255a2f0a1f8732bc2f268aee14a4d5c07f6ee3e957db86b69fdc194ec8393a283ea4ccfcae062f058f067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e626f57caf460a40ce5c68bb729f89d

SHA1
5f5811dccd00137f446a7e730498455b73200e6a

SHA256
383bff3becd737cd30b70787e74e774bfdfc5c10cf5bd7c0dcb6b24a4d9d5c92

SHA512
e6a12e1c8462e57371c7bb109f6e7ad2762c9f96bb1d3eaef74d34c62d8ca403929a74ae2b42f1a6006a694107721224404702b9bd436fff49ea05de625e8ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat

Filesize
214B

MD5
711fa6f87a29c2cd062dc9d3f05c9a8d

SHA1
2de5b478743dbf53bff3b337e553b003765a5a3c

SHA256
9e17eb946ee6052e1d6eff0417082cc12afa695346e55a4faf03557333a08df3

SHA512
575e90187ed7877a8b232c34ee032f3c5606281b4ae1d35e3426d59a6cc50facac22330011163d0487d581f1247b3014d634837dc94cdbc67fd6d7ee93f70534

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat

Filesize
214B

MD5
8a80e76781fa35b31f3054e14e16732b

SHA1
c25d229c941b08cd63ad092de6e7d9120ec9599b

SHA256
745e6b3a59f0a77a642c85c4bdfc094dba383c7620ed5b7b6232f465961433e8

SHA512
7e4dc9b26f9a34ea9dd4f91195750f484745121be075785a53d91db793b762bdfdd43ead5ff9c45be7241926924f4e0ac715581d188e496afd44559dcea2eb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat

Filesize
214B

MD5
06ec10847a2c02849f4b29f8a4884497

SHA1
d839139c86eb367655684907cb1b559acab04a91

SHA256
1ffb6d1eefec5eb1d733a22712923f44435e4c44a4ca5ba1445e53d50857187b

SHA512
51d762052f7b8d512f23a4b20bb9c4c1e9f1090a29075cbf71b723534741d018128df474ac163d43233f0a89cc74a511b6c2dbc12417660c3cb17f4a9bbc2d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\S2GQUB77UU.bat

Filesize
214B

MD5
cf77d4d01962f15890ba5587f2236f33

SHA1
a90abda7b8b1eaa9f4cd23011e85770a023d7647

SHA256
d44a13133941973e71c7abce92012640a92b7c043a1f2e67c670cafd99115c09

SHA512
1af7bfd9de3fe1a1cb90eee8b7d774548cb1021122b724d4987d5e8ea233085984d816cd6cdd05b9ac690076eccdfeb51894330c7a13435a492d78ab08674f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat

Filesize
214B

MD5
482fd982919aaef58eadec359839817b

SHA1
2af815af354457c39a8e94b867d56562706cc6cb

SHA256
316ade5ff8de599026eaac9d6e90801a7d57c0392ad31ccc3b416563d3b9290e

SHA512
26d7d37ecdeac6bb7b471b369ee5a19ec8f982afc8c0634eabb60a99ff7353a320ee8793eb9891717a94838ab69b7949b2eb74a7c7a73c3212d683592a7c7d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat

Filesize
214B

MD5
d08b8e144c054e1e30fe09f733b0573b

SHA1
90951eebd14d6de132fa7db157bf3e6eae97ad8a

SHA256
f4876702bfe79f9941c7374925a5c8ec8e3b18f112c9efece1d47cca40a750f8

SHA512
edba9791a422ecc6ef9429ca3b57664f7f8112cc5e08ba3dd5bfd93928abeb031798502f70b8ecbd2a99b0f1e67d9a1b7d47d970455a9b625517853f7a067f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat

Filesize
214B

MD5
178e9ad51e0732aa19787d7da0422c1e

SHA1
fa179eae982267bb07e9341e439218cbf42015b7

SHA256
56efe3540b5ac6eca40060ee77964805b608b9c7d55821b7c76ddde56b8518fe

SHA512
a629a4c5b9c02cf14a67e1ee8e38b4b89dd43f6e790b0eee42b1a4e140a4e426f35a4cb23685b7b3d271e25dfad094ca9c2582604a8f3a6db96522b0a94ee78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat

Filesize
214B

MD5
4dd3152348bf04dd27b2d5a4225b9d35

SHA1
dc9966a4c34e72d9dfff70fd0684f443420d4d08

SHA256
abe97e6f790c81ba9abca9ecc2e823c0c69c3ed9dc045b6be9f92e75e51c4a8d

SHA512
51b9e00f979473963929410792f86197963e1b63a64c09a43ebfec207be3ca80a99ab58902b4212d05c4fabf00f8564ebaf604fe8130495f71a804e119bc54bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat

Filesize
214B

MD5
65a8492f3ca46c66ff280d4da7fc53b2

SHA1
1f7db3a003b62434d5ab9513e61404fd036ec531

SHA256
16568721b7fba32f735d826ef60eb3ac165d86b2db6a26a45988f0e4148fc9ba

SHA512
909e0dbaf30e35d9e2a0d9c96894065784133bb0a6ffe366ca62d3f9221173bbeb71836c0febee6fb5be1f2126d8fdc94ccffeaeec8b754e54455cadb2ea8590

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjLuxY44un.bat

Filesize
199B

MD5
0fa0479de9acc566d5a600113bf59aa2

SHA1
5f3811f8f8e8b324eb6fa9856efe736a3e96c8b1

SHA256
f311bb2043e00e4dc8591536fa8dc598c9fe52536d3f8a252974a11a2388a6ca

SHA512
a2cfeaac5f29b35b472f2ed7d96af99191fc419780c8fcab0cf26f53f19125cc3dee71f63e7cfdcaeabc4740619f387c9c52d980a2709931ef8c14500f47413e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
448fc0f5c48fee3b3b34a036137609ce

SHA1
868b866732c791e680ea8d3558202e9a449cc02a

SHA256
445c59ee4079f4bfba9a0c60851cd68e95ec4cae75361fee93edc2eb89950d33

SHA512
e06a5fb109485645ab77cbb49a9c234b5fa0594a0810e8735a61779df56e7ced84afb84e3e33ea2f355ad7282e4d6fbf9146743e52d17632835b47dc8b80c5ca

Download Submit
C:\Users\Default\886983d96e3d3e

Filesize
974B

MD5
80c096f51ecdb7aacf2dec5ae430f910

SHA1
d9d7dbbecb43e4d7bad5ee6359ef81b50cf6612c

SHA256
e3a35f52b359996176b0361c95017d8ad5ee9e3c2a313094caf2a9a4c9a9c998

SHA512
bafab21815624ad21345bf2d4f7b380a77766ce90761eeb7a23f5a2bfbb05088e32bfe4a95473f50629f382d2504be820701120181c5aca74dd0f1cae2e829cc

Download Submit
C:\Users\Default\csrss.exe

Filesize
1.0MB

MD5
92953559db8620863b9103bc89ed5df3

SHA1
6136b224119553f23a31033241a4125ae58514aa

SHA256
00003173e1c4e4573cae631072dbefa3d3e04d6b71623c9cc7fc710b324c2bb9

SHA512
3f86f2f7eb3c119dbf285f0898fb4b84d21698e5bc4e34f9dce2a641da68a39b8bd532d0aeae48df9fec4e11188e9faa4ce86f684735e7ab6b37135b73f1a8fa

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1108-34-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/1108-37-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1676-106-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1676-108-0x0000000002060000-0x0000000002068000-memory.dmp

Filesize
32KB

Download
memory/1684-133-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/2072-569-0x00000000013D0000-0x00000000014E0000-memory.dmp

Filesize
1.1MB

Download
memory/2080-58-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2448-270-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2448-269-0x0000000001070000-0x0000000001180000-memory.dmp

Filesize
1.1MB

Download
memory/2572-629-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2808-389-0x00000000003C0000-0x00000000004D0000-memory.dmp

Filesize
1.1MB

Download
memory/2836-16-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2836-15-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/2836-17-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2836-14-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/2836-13-0x0000000001270000-0x0000000001380000-memory.dmp

Filesize
1.1MB

Download
memory/2908-450-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/2908-449-0x0000000001010000-0x0000000001120000-memory.dmp

Filesize
1.1MB

Download