dcrat | d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe
Size

1.3MB
MD5

c3eb38aa846e86ee2983be8dc52204ef
SHA1

fdb39bce400e93def646670afa578f083bc5e9d2
SHA256

d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f
SHA512

6a28fa053d33feed5946415b132755456b438d4ee99cec7f134ebe894da8319718e83268d9f8f205ef98c10845a508edb045f053a35da331e08bb29dc44faef2
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1880	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1880	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cb6-10.dat	dcrat
behavioral2/memory/3644-13-0x0000000000CC0000-0x0000000000DD0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3948	powershell.exe
5048	powershell.exe
3428	powershell.exe
1176	powershell.exe
5056	powershell.exe
3064	powershell.exe
1672	powershell.exe
1192	powershell.exe
3160	powershell.exe
1464	powershell.exe
4444	powershell.exe
316	powershell.exe
3624	powershell.exe
1576	powershell.exe
2652	powershell.exe
4828	powershell.exe
936	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	TextInputHost.exe

Executes dropped EXE 15 IoCs

pid	Process
3644	DllCommonsvc.exe
2372	TextInputHost.exe
2300	TextInputHost.exe
4680	TextInputHost.exe
5064	TextInputHost.exe
2968	TextInputHost.exe
2976	TextInputHost.exe
4372	TextInputHost.exe
3424	TextInputHost.exe
1848	TextInputHost.exe
1660	TextInputHost.exe
788	TextInputHost.exe
2632	TextInputHost.exe
3492	TextInputHost.exe
2448	TextInputHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
42	raw.githubusercontent.com
49	raw.githubusercontent.com
57	raw.githubusercontent.com
28	raw.githubusercontent.com
41	raw.githubusercontent.com
43	raw.githubusercontent.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
59	raw.githubusercontent.com
26	raw.githubusercontent.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\c5b4cb5e9653cc	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Web\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\Web\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\servicing\Packages\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Windows\IME\smss.exe	DllCommonsvc.exe
File created	C:\Windows\IME\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	TextInputHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5024	schtasks.exe
3316	schtasks.exe
1564	schtasks.exe
1196	schtasks.exe
2456	schtasks.exe
4980	schtasks.exe
2336	schtasks.exe
2732	schtasks.exe
2680	schtasks.exe
2264	schtasks.exe
2144	schtasks.exe
1544	schtasks.exe
4796	schtasks.exe
368	schtasks.exe
3032	schtasks.exe
1816	schtasks.exe
2928	schtasks.exe
3960	schtasks.exe
2384	schtasks.exe
1852	schtasks.exe
3492	schtasks.exe
428	schtasks.exe
2564	schtasks.exe
2416	schtasks.exe
1784	schtasks.exe
2648	schtasks.exe
5096	schtasks.exe
2116	schtasks.exe
4356	schtasks.exe
2288	schtasks.exe
1088	schtasks.exe
4652	schtasks.exe
3008	schtasks.exe
4808	schtasks.exe
1848	schtasks.exe
228	schtasks.exe
1212	schtasks.exe
1096	schtasks.exe
2412	schtasks.exe
904	schtasks.exe
4156	schtasks.exe
4960	schtasks.exe
3532	schtasks.exe
3148	schtasks.exe
760	schtasks.exe
1620	schtasks.exe
1556	schtasks.exe
2444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
3644	DllCommonsvc.exe
2652	powershell.exe
5056	powershell.exe
5056	powershell.exe
2652	powershell.exe
1464	powershell.exe
1464	powershell.exe
4828	powershell.exe
4828	powershell.exe
1576	powershell.exe
1576	powershell.exe
936	powershell.exe
936	powershell.exe
1192	powershell.exe
1192	powershell.exe
3160	powershell.exe
3160	powershell.exe
3428	powershell.exe
3428	powershell.exe
1176	powershell.exe
1176	powershell.exe
1672	powershell.exe
1672	powershell.exe
4444	powershell.exe
4444	powershell.exe
3624	powershell.exe
3624	powershell.exe
3064	powershell.exe
3064	powershell.exe
3948	powershell.exe
3948	powershell.exe
5048	powershell.exe
5048	powershell.exe
316	powershell.exe
316	powershell.exe
3428	powershell.exe
936	powershell.exe
1464	powershell.exe
4828	powershell.exe
4444	powershell.exe
1192	powershell.exe
2652	powershell.exe
3624	powershell.exe
5048	powershell.exe
5056	powershell.exe
3160	powershell.exe
1176	powershell.exe
1672	powershell.exe
1576	powershell.exe
3948	powershell.exe
3064	powershell.exe
316	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	DllCommonsvc.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2372	TextInputHost.exe
Token: SeDebugPrivilege	2300	TextInputHost.exe
Token: SeDebugPrivilege	4680	TextInputHost.exe
Token: SeDebugPrivilege	5064	TextInputHost.exe
Token: SeDebugPrivilege	2968	TextInputHost.exe
Token: SeDebugPrivilege	2976	TextInputHost.exe
Token: SeDebugPrivilege	4372	TextInputHost.exe
Token: SeDebugPrivilege	3424	TextInputHost.exe
Token: SeDebugPrivilege	1848	TextInputHost.exe
Token: SeDebugPrivilege	1660	TextInputHost.exe
Token: SeDebugPrivilege	788	TextInputHost.exe
Token: SeDebugPrivilege	2632	TextInputHost.exe
Token: SeDebugPrivilege	3492	TextInputHost.exe
Token: SeDebugPrivilege	2448	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 812	4380	JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe	82
PID 4380 wrote to memory of 812	4380	JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe	82
PID 4380 wrote to memory of 812	4380	JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe	82
PID 812 wrote to memory of 1140	812	WScript.exe	83
PID 812 wrote to memory of 1140	812	WScript.exe	83
PID 812 wrote to memory of 1140	812	WScript.exe	83
PID 1140 wrote to memory of 3644	1140	cmd.exe	85
PID 1140 wrote to memory of 3644	1140	cmd.exe	85
PID 3644 wrote to memory of 3948	3644	DllCommonsvc.exe	135
PID 3644 wrote to memory of 3948	3644	DllCommonsvc.exe	135
PID 3644 wrote to memory of 1192	3644	DllCommonsvc.exe	136
PID 3644 wrote to memory of 1192	3644	DllCommonsvc.exe	136
PID 3644 wrote to memory of 3624	3644	DllCommonsvc.exe	137
PID 3644 wrote to memory of 3624	3644	DllCommonsvc.exe	137
PID 3644 wrote to memory of 936	3644	DllCommonsvc.exe	138
PID 3644 wrote to memory of 936	3644	DllCommonsvc.exe	138
PID 3644 wrote to memory of 316	3644	DllCommonsvc.exe	139
PID 3644 wrote to memory of 316	3644	DllCommonsvc.exe	139
PID 3644 wrote to memory of 1176	3644	DllCommonsvc.exe	140
PID 3644 wrote to memory of 1176	3644	DllCommonsvc.exe	140
PID 3644 wrote to memory of 3428	3644	DllCommonsvc.exe	141
PID 3644 wrote to memory of 3428	3644	DllCommonsvc.exe	141
PID 3644 wrote to memory of 4444	3644	DllCommonsvc.exe	142
PID 3644 wrote to memory of 4444	3644	DllCommonsvc.exe	142
PID 3644 wrote to memory of 1672	3644	DllCommonsvc.exe	143
PID 3644 wrote to memory of 1672	3644	DllCommonsvc.exe	143
PID 3644 wrote to memory of 4828	3644	DllCommonsvc.exe	144
PID 3644 wrote to memory of 4828	3644	DllCommonsvc.exe	144
PID 3644 wrote to memory of 3064	3644	DllCommonsvc.exe	145
PID 3644 wrote to memory of 3064	3644	DllCommonsvc.exe	145
PID 3644 wrote to memory of 5056	3644	DllCommonsvc.exe	146
PID 3644 wrote to memory of 5056	3644	DllCommonsvc.exe	146
PID 3644 wrote to memory of 2652	3644	DllCommonsvc.exe	147
PID 3644 wrote to memory of 2652	3644	DllCommonsvc.exe	147
PID 3644 wrote to memory of 1464	3644	DllCommonsvc.exe	148
PID 3644 wrote to memory of 1464	3644	DllCommonsvc.exe	148
PID 3644 wrote to memory of 5048	3644	DllCommonsvc.exe	150
PID 3644 wrote to memory of 5048	3644	DllCommonsvc.exe	150
PID 3644 wrote to memory of 3160	3644	DllCommonsvc.exe	151
PID 3644 wrote to memory of 3160	3644	DllCommonsvc.exe	151
PID 3644 wrote to memory of 1576	3644	DllCommonsvc.exe	152
PID 3644 wrote to memory of 1576	3644	DllCommonsvc.exe	152
PID 3644 wrote to memory of 1184	3644	DllCommonsvc.exe	169
PID 3644 wrote to memory of 1184	3644	DllCommonsvc.exe	169
PID 1184 wrote to memory of 2624	1184	cmd.exe	171
PID 1184 wrote to memory of 2624	1184	cmd.exe	171
PID 1184 wrote to memory of 2372	1184	cmd.exe	175
PID 1184 wrote to memory of 2372	1184	cmd.exe	175
PID 2372 wrote to memory of 740	2372	TextInputHost.exe	179
PID 2372 wrote to memory of 740	2372	TextInputHost.exe	179
PID 740 wrote to memory of 3664	740	cmd.exe	181
PID 740 wrote to memory of 3664	740	cmd.exe	181
PID 740 wrote to memory of 2300	740	cmd.exe	182
PID 740 wrote to memory of 2300	740	cmd.exe	182
PID 2300 wrote to memory of 4356	2300	TextInputHost.exe	184
PID 2300 wrote to memory of 4356	2300	TextInputHost.exe	184
PID 4356 wrote to memory of 3644	4356	cmd.exe	186
PID 4356 wrote to memory of 3644	4356	cmd.exe	186
PID 4356 wrote to memory of 4680	4356	cmd.exe	188
PID 4356 wrote to memory of 4680	4356	cmd.exe	188
PID 4680 wrote to memory of 1500	4680	TextInputHost.exe	189
PID 4680 wrote to memory of 1500	4680	TextInputHost.exe	189
PID 1500 wrote to memory of 3496	1500	cmd.exe	191
PID 1500 wrote to memory of 3496	1500	cmd.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d08ced3a933d49adbbbe26e91fdcb79a09a2cf9d34083aa43cfdf34678b3855f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tdxGn9XJsn.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2624
      - C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3664
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3644
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SpZgFYZT4y.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3496
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
        13⤵
        
        PID:3692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4332
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat"
        15⤵
        
        PID:2604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1008
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat"
        17⤵
        
        PID:2624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:216
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
        19⤵
        
        PID:2372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2320
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"
        21⤵
        
        PID:2776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4532
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat"
        23⤵
        
        PID:4140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2800
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat"
        25⤵
        
        PID:5060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1248
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ww6iFNwlpp.bat"
        27⤵
        
        PID:3604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4960
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
        29⤵
        
        PID:2376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4036
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PoOVO2yVWN.bat"
        31⤵
        
        PID:1096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:2576
        
        C:\providercommon\TextInputHost.exe
        
        "C:\providercommon\TextInputHost.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\providercommon\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\providercommon\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\IME\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\Edge\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Web\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Services\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
600B

MD5
c7ba2c9a0b8426a3d58d0d15e5ac4284

SHA1
ad5646a227320194e4fd0901d4372b0002dad3cb

SHA256
ed01c3e3d2e6e46a235a9159f5eee7895b2b043dfe5f82b867a0e1996d6fd8a4

SHA512
91cddd12d65c1dcc7f248f218156b8613148229bdbaf9990a807d44a0438cdbc761258c31e9fe6f8863f06793a77c8212bc1ab5cb1f9105ce049d72720e7eb9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat

Filesize
200B

MD5
65da2df1fb1a7d388d940c0cb651877f

SHA1
f9f1f3c10d2c248947f1ca7b89e3a50d4349b5d4

SHA256
8605f5c58b09ebe526e6d76a1da2804f430e6c7b7fe2f472b334b2853f11a881

SHA512
305e80019ba99fe5e5bbf702d379a89adfbaed38172efdc4bb44e06e083e89b19423f8d9727aac9e4acbf6c421baaf6b0784f61a542bcac3f29330cd65d554f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat

Filesize
200B

MD5
026b0a5b7198590056b7a35d3d13a475

SHA1
c346f9df58f003cd7d0d28b163398543b3d81105

SHA256
d1802d36e98d9356f2f44ea03dd687e24690831730035b46d3fd1aec16e893d9

SHA512
7c176f3e22490442346477694d7ce68962da680d731e643f0f1bdcb6f535648efe4d19df722e2edd124f814721e8acd4b0645f30007d441b294c353dbb6c22c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\PoOVO2yVWN.bat

Filesize
200B

MD5
f1293e24d86eefc2f7e22f30e311207b

SHA1
ddd11a29b6420389f85b55c84ae80f20b78023c2

SHA256
e3f2bc609d4d7a2a2569348920bbd06b55fd139985145a680447e3a2f5633396

SHA512
726b4cfa37ed705c74d0283abb264ed3da3cd4e8e82a226b21d2ebf95bf5837df3f4d6b9a4fb5c320720af9136e42a475814bbbcb4f38e479d3078098c2d6153

Download Submit
C:\Users\Admin\AppData\Local\Temp\SpZgFYZT4y.bat

Filesize
200B

MD5
426e9da9c61f22a2a28ae2879e47b370

SHA1
d0a9acb3a5b0b84db039b5355c704562181d52d1

SHA256
c0e8f242048e439d5a07a60759093c96c17b4dadfc4526072162a764aa10413d

SHA512
84e911b49e467bd482f160858244b36f2f306149bde02c5cebf7373896b6a99ebb5836336702aef03ee8516d124ce6501a40a4a32ea83745328b4f2b31613a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ww6iFNwlpp.bat

Filesize
200B

MD5
198cca8dc19453099e70efe61e0e6805

SHA1
df6f2edf0bad232074bdfa52a4b7fac92d22ecf7

SHA256
9e2ffc00f4f79fd6e2f69dc73938a8aa241e6e55f7649f814b2b02cb99a3da3b

SHA512
19da62aa90d211714b36301a857bcdda67d265f73c1439e89914ed88c66d184085cd15c4c29a6c894a9e005b70f2e85f46fd139b91df4da44822612823a01fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat

Filesize
200B

MD5
fd36d8812de9021a6fe6c4d698e370f6

SHA1
9d8c9eaa2bd5b44775efb4db2d9c4f5899314227

SHA256
58c49c4a8b64ccffe920da9dbcf79446a144258721f552bbd5dfbe491c3893bd

SHA512
516bac88f69d6e610711f75124ae789fc5da75bad4be416f930bf7a85d06b28e6998e9304c77c8444f1abc9a82c917689bb18b2be90130613d6fd76eca64693b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat

Filesize
200B

MD5
b5bfd4e48adbc5bc994e9ef80c79979a

SHA1
7c767991a9bdf54643369fc1a3f4e0c972e76d7a

SHA256
dde3d7e6f85f83d5448ee401a16dcc7bc67726dca0669ab2b31a5b7be7ffe638

SHA512
470541c815ed8585560fa4f495ac7fd6cc6191103b9c14243a4c6a9228bdf29efc15d8da839c16e304e92288fd31b2a2bf3a05261fa2bf74a650cf3a2d7dca10

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdwxg01b.maq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat

Filesize
200B

MD5
98e205352335e71326c05f9a3ffe7fdd

SHA1
8fb27c1d5f36dca77a7cf15133be66a81f1c0dee

SHA256
e85d79b5ad9eeae2b2f852984dd522df2684b1d7dd6000506992b8b8367d87e1

SHA512
d2d1122c00cf9619faea493ddaf11559367a43834e97383cfa502137664e05ee176aea4338d19316da2cb97427657c23fbd3a21bc9715a66bc88ea2816bdb5a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat

Filesize
200B

MD5
47ba6eb569afa1aaea3f7133f4418a42

SHA1
31f954d1b915c56b27ea3fe2f1324135737d1f09

SHA256
07fd5a92e101f4d3e1a08e743233d32b0a146e922bab150daf89e3fd9c9ef517

SHA512
1a60d55cb38c0d53d7dba9d8daa58048678183e2d1281a6e9b5065b8ffd93e570afb6a8367e0857b8569b9584488a1099d2cdf6fee30e6d81ab8ac542b265ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

Filesize
200B

MD5
38432a842e9bfeb5d448b85310655485

SHA1
e0e4d8d6c5894369d51eb74f0ac98d1d45a1fa8b

SHA256
f03b516aaecc0d4cb206ef8040faa90c96ff3fb2a00be78c97179a05caa9c7e6

SHA512
3a1af349f467ee69826aae722d0d81f5ff2956c39490d2daec4881bd52141cc364711331197e0a10a620ad17b7add545112f35fb8bebb0158d814964b6f208d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tdxGn9XJsn.bat

Filesize
200B

MD5
5af5b97342165930a3392d3446c753a5

SHA1
dc738c1e209d959f04665d9f6e7dcb492de9d0a8

SHA256
28b9d2d646df34c270a670271ac03f635948691a508770e666f515981b88f663

SHA512
6236f9de8504cc89e4b1ec28dabbe7026f0e024cfed20a13763c866696ec5dc8dd2aed8ef9ea3ef9e52848a14d7768ee62f6ee8d0449794155a45de470f9b04e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat

Filesize
200B

MD5
3dccbe55465747b61fffdf9b58590a1e

SHA1
b5aa4e7fb528d397cbc9a720816c951fe08f3c5e

SHA256
abfa7a4a0944acb8959dea1261ed3008e7d8d9d9d329551000fc6a4d9daa1531

SHA512
ca62515a7f7422932760105ed73692c030ffd2b44698faa1af15035b3b24b498fd1f77e92a53d912d7706f2b7d208f1649791f26faafb176071da6d061d6d87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat

Filesize
200B

MD5
a79f9fdc285bfcfd40d89d5c11062c4d

SHA1
632b34f6275c4e206afe1c0fb810afb776bdb854

SHA256
7045992c7a2dad32038de38a15b363e66dd75f3dd34345331e0f9a085bb7ca83

SHA512
d7e9057e67eae534b485387b771ee07baa69232dbd9909c94a24e8252f89aa95b7d16912abaa731af25075a8cf6590ee5d255ea59ee07f73125228d60222b6af

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/936-61-0x000001CA39C30000-0x000001CA39C52000-memory.dmp

Filesize
136KB

Download
memory/1660-316-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/1848-309-0x0000000000F60000-0x0000000000F72000-memory.dmp

Filesize
72KB

Download
memory/2300-258-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/2300-263-0x000000001C0B0000-0x000000001C21A000-memory.dmp

Filesize
1.4MB

Download
memory/2372-255-0x000000001C9D0000-0x000000001CB3A000-memory.dmp

Filesize
1.4MB

Download
memory/2372-248-0x00000000030F0000-0x0000000003102000-memory.dmp

Filesize
72KB

Download
memory/2968-285-0x000000001BDF0000-0x000000001BF99000-memory.dmp

Filesize
1.7MB

Download
memory/2976-287-0x0000000002B80000-0x0000000002B92000-memory.dmp

Filesize
72KB

Download
memory/2976-292-0x000000001C4E0000-0x000000001C689000-memory.dmp

Filesize
1.7MB

Download
memory/3644-17-0x0000000003000000-0x000000000300C000-memory.dmp

Filesize
48KB

Download
memory/3644-16-0x0000000002FE0000-0x0000000002FEC000-memory.dmp

Filesize
48KB

Download
memory/3644-15-0x0000000002FF0000-0x0000000002FFC000-memory.dmp

Filesize
48KB

Download
memory/3644-14-0x0000000002FD0000-0x0000000002FE2000-memory.dmp

Filesize
72KB

Download
memory/3644-13-0x0000000000CC0000-0x0000000000DD0000-memory.dmp

Filesize
1.1MB

Download
memory/3644-12-0x00007FFC2DE83000-0x00007FFC2DE85000-memory.dmp

Filesize
8KB

Download
memory/4372-301-0x000000001C3C0000-0x000000001C569000-memory.dmp

Filesize
1.7MB

Download
memory/4372-295-0x0000000002A30000-0x0000000002A42000-memory.dmp

Filesize
72KB

Download
memory/4680-270-0x000000001BDE0000-0x000000001BF89000-memory.dmp

Filesize
1.7MB

Download
memory/5064-278-0x000000001C3B0000-0x000000001C559000-memory.dmp

Filesize
1.7MB

Download