dcrat | 20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe
Size

1.3MB
MD5

47d37f46255dc1016bd76a883138c36d
SHA1

e4ee8d4c28ef087cd5eb3b348b180fcb9227817c
SHA256

20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07
SHA512

7f8f01c91fdd6c71f5f5910975cc2b553d36645119f16679297e6918241f94f1b64f248aaa0b0797931f8f5a79e4e33910ed59b79b3730f5500d2d8563911a32
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3652	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3652	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cbe-9.dat	dcrat
behavioral2/memory/1432-13-0x0000000000160000-0x0000000000270000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe
4976	powershell.exe
1092	powershell.exe
384	powershell.exe
2752	powershell.exe
2292	powershell.exe
1656	powershell.exe
1600	powershell.exe
3860	powershell.exe
3300	powershell.exe
3560	powershell.exe
1192	powershell.exe
3624	powershell.exe
2008	powershell.exe
1196	powershell.exe
1384	powershell.exe
4564	powershell.exe
1296	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 16 IoCs

pid	Process
1432	DllCommonsvc.exe
2536	DllCommonsvc.exe
3848	fontdrvhost.exe
5560	fontdrvhost.exe
5836	fontdrvhost.exe
864	fontdrvhost.exe
4048	fontdrvhost.exe
4696	fontdrvhost.exe
2292	fontdrvhost.exe
4176	fontdrvhost.exe
5316	fontdrvhost.exe
5556	fontdrvhost.exe
5988	fontdrvhost.exe
1564	fontdrvhost.exe
3980	fontdrvhost.exe
1068	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
44	raw.githubusercontent.com
20	raw.githubusercontent.com
43	raw.githubusercontent.com
53	raw.githubusercontent.com
22	raw.githubusercontent.com
36	raw.githubusercontent.com
38	raw.githubusercontent.com
42	raw.githubusercontent.com
49	raw.githubusercontent.com
50	raw.githubusercontent.com
37	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\es-ES\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\sppsvc.exe	DllCommonsvc.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\WaaS\tasks\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Windows\uk-UA\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\uk-UA\55b276f4edf653	DllCommonsvc.exe
File created	C:\Windows\INF\.NET CLR Networking\0409\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\uk-UA\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-display-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_2eacafd176537a3a\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\smss.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\INF\.NET CLR Networking\0409\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\uk-UA\StartMenuExperienceHost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5024	schtasks.exe
4816	schtasks.exe
3872	schtasks.exe
2400	schtasks.exe
4984	schtasks.exe
3292	schtasks.exe
452	schtasks.exe
540	schtasks.exe
4796	schtasks.exe
2956	schtasks.exe
2248	schtasks.exe
1208	schtasks.exe
1664	schtasks.exe
4556	schtasks.exe
2128	schtasks.exe
4780	schtasks.exe
2936	schtasks.exe
3336	schtasks.exe
1084	schtasks.exe
3076	schtasks.exe
2552	schtasks.exe
864	schtasks.exe
112	schtasks.exe
3532	schtasks.exe
1468	schtasks.exe
2624	schtasks.exe
2764	schtasks.exe
628	schtasks.exe
4200	schtasks.exe
1736	schtasks.exe
5020	schtasks.exe
2252	schtasks.exe
3064	schtasks.exe
1752	schtasks.exe
2296	schtasks.exe
4444	schtasks.exe
1224	schtasks.exe
3968	schtasks.exe
4472	schtasks.exe
5060	schtasks.exe
2260	schtasks.exe
4988	schtasks.exe
1704	schtasks.exe
2108	schtasks.exe
1088	schtasks.exe
1664	schtasks.exe
4240	schtasks.exe
4872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1432	DllCommonsvc.exe
1432	DllCommonsvc.exe
1432	DllCommonsvc.exe
1432	DllCommonsvc.exe
1432	DllCommonsvc.exe
1432	DllCommonsvc.exe
1432	DllCommonsvc.exe
4564	powershell.exe
3624	powershell.exe
2008	powershell.exe
1600	powershell.exe
3624	powershell.exe
1600	powershell.exe
4564	powershell.exe
2008	powershell.exe
2536	DllCommonsvc.exe
2536	DllCommonsvc.exe
2536	DllCommonsvc.exe
2292	powershell.exe
2292	powershell.exe
1196	powershell.exe
3560	powershell.exe
3560	powershell.exe
1196	powershell.exe
1296	powershell.exe
1296	powershell.exe
3860	powershell.exe
3860	powershell.exe
1384	powershell.exe
1384	powershell.exe
4500	powershell.exe
4500	powershell.exe
4976	powershell.exe
4976	powershell.exe
3300	powershell.exe
3300	powershell.exe
2752	powershell.exe
2752	powershell.exe
1092	powershell.exe
1092	powershell.exe
1192	powershell.exe
1192	powershell.exe
384	powershell.exe
384	powershell.exe
1656	powershell.exe
3560	powershell.exe
1656	powershell.exe
3848	fontdrvhost.exe
3848	fontdrvhost.exe
1192	powershell.exe
3300	powershell.exe
2292	powershell.exe
1656	powershell.exe
1196	powershell.exe
1092	powershell.exe
4976	powershell.exe
4500	powershell.exe
1296	powershell.exe
3860	powershell.exe
384	powershell.exe
2752	powershell.exe
1384	powershell.exe
5560	fontdrvhost.exe
5836	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	DllCommonsvc.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	2536	DllCommonsvc.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	3848	fontdrvhost.exe
Token: SeDebugPrivilege	5560	fontdrvhost.exe
Token: SeDebugPrivilege	5836	fontdrvhost.exe
Token: SeDebugPrivilege	864	fontdrvhost.exe
Token: SeDebugPrivilege	4048	fontdrvhost.exe
Token: SeDebugPrivilege	4696	fontdrvhost.exe
Token: SeDebugPrivilege	2292	fontdrvhost.exe
Token: SeDebugPrivilege	4176	fontdrvhost.exe
Token: SeDebugPrivilege	5316	fontdrvhost.exe
Token: SeDebugPrivilege	5556	fontdrvhost.exe
Token: SeDebugPrivilege	5988	fontdrvhost.exe
Token: SeDebugPrivilege	1564	fontdrvhost.exe
Token: SeDebugPrivilege	3980	fontdrvhost.exe
Token: SeDebugPrivilege	1068	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4168	3616	JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe	83
PID 3616 wrote to memory of 4168	3616	JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe	83
PID 3616 wrote to memory of 4168	3616	JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe	83
PID 4168 wrote to memory of 3312	4168	WScript.exe	85
PID 4168 wrote to memory of 3312	4168	WScript.exe	85
PID 4168 wrote to memory of 3312	4168	WScript.exe	85
PID 3312 wrote to memory of 1432	3312	cmd.exe	87
PID 3312 wrote to memory of 1432	3312	cmd.exe	87
PID 1432 wrote to memory of 3624	1432	DllCommonsvc.exe	99
PID 1432 wrote to memory of 3624	1432	DllCommonsvc.exe	99
PID 1432 wrote to memory of 4564	1432	DllCommonsvc.exe	100
PID 1432 wrote to memory of 4564	1432	DllCommonsvc.exe	100
PID 1432 wrote to memory of 2008	1432	DllCommonsvc.exe	101
PID 1432 wrote to memory of 2008	1432	DllCommonsvc.exe	101
PID 1432 wrote to memory of 1600	1432	DllCommonsvc.exe	102
PID 1432 wrote to memory of 1600	1432	DllCommonsvc.exe	102
PID 1432 wrote to memory of 1500	1432	DllCommonsvc.exe	107
PID 1432 wrote to memory of 1500	1432	DllCommonsvc.exe	107
PID 1500 wrote to memory of 3356	1500	cmd.exe	109
PID 1500 wrote to memory of 3356	1500	cmd.exe	109
PID 1500 wrote to memory of 2536	1500	cmd.exe	117
PID 1500 wrote to memory of 2536	1500	cmd.exe	117
PID 2536 wrote to memory of 2292	2536	DllCommonsvc.exe	160
PID 2536 wrote to memory of 2292	2536	DllCommonsvc.exe	160
PID 2536 wrote to memory of 1092	2536	DllCommonsvc.exe	161
PID 2536 wrote to memory of 1092	2536	DllCommonsvc.exe	161
PID 2536 wrote to memory of 3560	2536	DllCommonsvc.exe	162
PID 2536 wrote to memory of 3560	2536	DllCommonsvc.exe	162
PID 2536 wrote to memory of 1196	2536	DllCommonsvc.exe	163
PID 2536 wrote to memory of 1196	2536	DllCommonsvc.exe	163
PID 2536 wrote to memory of 3300	2536	DllCommonsvc.exe	164
PID 2536 wrote to memory of 3300	2536	DllCommonsvc.exe	164
PID 2536 wrote to memory of 1656	2536	DllCommonsvc.exe	165
PID 2536 wrote to memory of 1656	2536	DllCommonsvc.exe	165
PID 2536 wrote to memory of 384	2536	DllCommonsvc.exe	167
PID 2536 wrote to memory of 384	2536	DllCommonsvc.exe	167
PID 2536 wrote to memory of 1296	2536	DllCommonsvc.exe	168
PID 2536 wrote to memory of 1296	2536	DllCommonsvc.exe	168
PID 2536 wrote to memory of 3860	2536	DllCommonsvc.exe	170
PID 2536 wrote to memory of 3860	2536	DllCommonsvc.exe	170
PID 2536 wrote to memory of 4500	2536	DllCommonsvc.exe	171
PID 2536 wrote to memory of 4500	2536	DllCommonsvc.exe	171
PID 2536 wrote to memory of 1384	2536	DllCommonsvc.exe	172
PID 2536 wrote to memory of 1384	2536	DllCommonsvc.exe	172
PID 2536 wrote to memory of 1192	2536	DllCommonsvc.exe	173
PID 2536 wrote to memory of 1192	2536	DllCommonsvc.exe	173
PID 2536 wrote to memory of 4976	2536	DllCommonsvc.exe	174
PID 2536 wrote to memory of 4976	2536	DllCommonsvc.exe	174
PID 2536 wrote to memory of 2752	2536	DllCommonsvc.exe	175
PID 2536 wrote to memory of 2752	2536	DllCommonsvc.exe	175
PID 2536 wrote to memory of 3848	2536	DllCommonsvc.exe	188
PID 2536 wrote to memory of 3848	2536	DllCommonsvc.exe	188
PID 3848 wrote to memory of 5364	3848	fontdrvhost.exe	190
PID 3848 wrote to memory of 5364	3848	fontdrvhost.exe	190
PID 5364 wrote to memory of 5428	5364	cmd.exe	192
PID 5364 wrote to memory of 5428	5364	cmd.exe	192
PID 5364 wrote to memory of 5560	5364	cmd.exe	194
PID 5364 wrote to memory of 5560	5364	cmd.exe	194
PID 5560 wrote to memory of 5716	5560	fontdrvhost.exe	196
PID 5560 wrote to memory of 5716	5560	fontdrvhost.exe	196
PID 5716 wrote to memory of 5768	5716	cmd.exe	198
PID 5716 wrote to memory of 5768	5716	cmd.exe	198
PID 5716 wrote to memory of 5836	5716	cmd.exe	200
PID 5716 wrote to memory of 5836	5716	cmd.exe	200

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20bf6832e4bb97036bb86a2e9afb7ba6d52c8e995ee186942f92aa9bcae11c07.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Ease of Access Themes\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d4IjOEVlLZ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1500
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3356
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\.NET CLR Networking\0409\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\upfc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\StartMenuExperienceHost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5428
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5768
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat"
        12⤵
        
        PID:6140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3692
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat"
        14⤵
        
        PID:2644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4756
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat"
        16⤵
        
        PID:1600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4336
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat"
        18⤵
        
        PID:4784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2092
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"
        20⤵
        
        PID:1384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:872
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat"
        22⤵
        
        PID:4036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4912
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat"
        24⤵
        
        PID:5452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:5552
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat"
        26⤵
        
        PID:5788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:5752
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
        28⤵
        
        PID:5848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:1820
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"
        30⤵
        
        PID:1180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:3976
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat"
        32⤵
        
        PID:2204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:4332
        
        C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe
        
        "C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\providercommon\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Ease of Access Themes\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Ease of Access Themes\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Default\PrintHood\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\.NET CLR Networking\0409\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\INF\.NET CLR Networking\0409\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\.NET CLR Networking\0409\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\uk-UA\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Public\Downloads\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Downloads\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
085e0a3b869f290afea5688a8ac4e7c5

SHA1
0fedef5057708908bcca9e7572be8f46cef4f3ca

SHA256
1fed2c9bc05b3fcb93f493124dbf1680c6445f67e3d49680257183132514509c

SHA512
bbac0555a05dbe83154a90caa44a653c8a05c87594a211548b165c5b1d231e3818830e754c0b6de3e5cb64dba3a5ad18bebae05cb9157e1dd46bce2a86d18ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3bdf0f0bc4de32a6f32ecb8a32ba5df1

SHA1
900c6a905984e5e16f3efe01ce2b2cc725fc64f1

SHA256
c893092af552e973c44e0596d1509605a393896a0c1eae64f11456dc956ba40e

SHA512
680d8f42fd4cb1fffa52e1f7cc483e8afc79c8f3e25ebfe5324c7c277d88499cc58324313599e307e47ba3ee4004de7554192203413cb061a29170cd9bc889c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
08526e4d8fed0a382c243c9aa8b1fe45

SHA1
f3da4b97529aaa38230db8bfa34a345bbc211622

SHA256
b5044625d66b7835745c7c4efa14d21aaf4ee42bf971f8bbc44f04416b91441f

SHA512
cbeb569db60eabd89c13b073f1bdf7ba991b6206e75f548396a150b08a0ffed1962d88d664e069c64ac740afbb69941df2f43e81a3f138e2185934967898941d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
057e7742b25e65a341d1341da25b54a8

SHA1
65c874ac4f429a4172bdf89a73922e39873ecab6

SHA256
f8cf996545599e442f94820af5c724fca27d22de96bcef6aa308d0520c3a1468

SHA512
94b461e3705336b9ebf10df506f4a436cee20ac60540cfb6fd2f36c48e011836bf1f9e3f00e5b254ad6e6f1338a976dba495d398b4459687f518e815afde04e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0517d7daa86e87ab93c37adcb931f498

SHA1
6b243308a84f033c4943c7f63c0f824d8db31a13

SHA256
3a962e5df85eedfa6b55bc984b49cf87f3ee67b81b849121f05defb6cafcad28

SHA512
a573701c9048be1cc7562d76ad5c5ec3be0928d476bcd2deb18e7585391d5d239dea81b528279f2d97c9dff6c08e1c10251b8e7ac162e6b57e602d2d9818593b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8fbdf20dd30b6ccf91308090184986d8

SHA1
fde6e3a60582552e322af16289c63d6943a18a78

SHA256
3b67692f7e6b5569626ecbf266289b9ae7cb4dc40ee5165eb6c6ea70c5f1f78b

SHA512
3ceefad823f555c522d46b266a6c77ea51002f1fb7426992f8a4ea70f0b9cf1ab6979db319c480cfcd51dc393407d3de5e111368b951a6d15766aa296045ffee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
0df0d0fe4346c59c4b3a2673c3250566

SHA1
a59972acab6df0ab0e2367ed25478d7ff26b6db8

SHA256
21954ff21cf3cbee00b7124dadeb1a7f47df83fbdb98e13c5c617610272e31b6

SHA512
1867b88a42e5e8ae506b78e40da7fb3d3b11dee09a4e826ed38e0f28292459156d45df8ab65481ae13e32da3582f273d94af9af8874e1903941ea5214d11b150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
192B

MD5
44c96474ccc390d21c514b412ed2fc24

SHA1
750858daa2aca34e187b50bac569b862f8716a5e

SHA256
cd46fa615e1a759c4d8d723d5d10987059f0c8f6be63c8b98efb54aaa7fb039f

SHA512
67a8cb43da81caabca4dcfe3b4c5a05222da81bc6ca314e991bdfe28362f7c58e66c837a5b8facc67e4bc602ef191db9680f75e1395601e69d59d29d0a0af636

Download Submit
C:\Users\Admin\AppData\Local\Temp\H7kUlUtrsw.bat

Filesize
220B

MD5
1a39985df18701d0c5be2482dcece8a8

SHA1
e9c4fd961c7ecb765ac58ca7214c38f81e2f6d2b

SHA256
0671e64f77ece91961b354e6b62d5a0fdab1515faa7a2bde35af2d0f483703af

SHA512
50c8a08b2bcb6944546ce2ed419cf3f5a2800849aa67fb677bf10bd65635a65e5df24c4fe8bfa4e6e2d53e2e4b618f6fb2b3bb3e9ae75b7bfec5143f7387336c

Download Submit
C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat

Filesize
220B

MD5
f5c34ba93fb6c9fda23cbbbfb5d16f23

SHA1
ad52f3b0eb13ec62c033c58f5ee0bf3fbc033e0f

SHA256
f88a5d7b94b07a2125b748d425bcb54dd201c7dcaff50e7bffe59be9aa229800

SHA512
76b9d83dadca99dcd9331a4d25d137e174856f5c609aea8f98c5e2b1850a020e94bbc7384e92bd0f0d513c4a7f2148bd9ffe72c133ad966f315e88bd7b405797

Download Submit
C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat

Filesize
220B

MD5
ec25db072297574f2a76ffc37f773a4d

SHA1
edba760291239b89c81b31313a8ba6e24c5df608

SHA256
166fa9e13fd095752b3e47c814e53a8d6dc9ca1d279d69c9aedbec697119b09d

SHA512
eb34cb64c55199e55267e66bc4c5058be193891390bb712325b52c5beaddfa9ee5518610ce1da5c91d7c3a6d0bc3b88b94bda06d0b46e97219809466766a28d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfrq2fss.rde.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat

Filesize
220B

MD5
2e5cb1f8256d36b25fbe4b0f1029edd4

SHA1
b095f0b4f569b6c84407eace8022708432d0879d

SHA256
b652489a37788f4bda79223f4d4f7440299de8f60da0695f8439405f86a194ad

SHA512
bb1b0da397bf38a49f0c1ea0756ab4a67d64a9dbf6e86a2dd784a707567db59cb21c41a8a6c58a38a70996f54acf5c932572f80000bd669d52e99da6ae65ad43

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4IjOEVlLZ.bat

Filesize
199B

MD5
2f9128155dcc827e59cfeed6744b15c1

SHA1
68f69d41036eaa25730595ab6c62e2c422a16559

SHA256
87a337de43bf4bcd03439e17bca2c6f96dd05dc8ebc011cf7d6173fa0e127333

SHA512
07248152e8c850ebecf07452d1bc8c9c060d0a2147ac30c92a0a9c1826de1a03bf512d85098b60881ce90a026700c82541ddb1f0c1fad2651f1d3febbdb02285

Download Submit
C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat

Filesize
220B

MD5
12d1c9d62674b9313a7e2e0266bf8c95

SHA1
56d87dc9c585f8e7a87a6160f096ba9414a60386

SHA256
db100ee1173a82c893c46a6507c742937d5b140b90e60a7876010fac3ad73fb3

SHA512
23a8355e9e6871a77b6b026903fa65030827b13aba717e74f4d1e6235004a10123aac047f070d1fa96e8460e611e8f536a437956b34f701e5ebb9527e7450fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat

Filesize
220B

MD5
cc36957fd69bc82bce912444823cf4e9

SHA1
4d47a0820b447dee8a127b9ab9614168a8cb25ba

SHA256
dd31f66afc5fe96777d7c31dd8308f9529e8d38b4dd26ad2984aaf33df9cc8ba

SHA512
27114b805c85c69ce107dd5160913ba78f4e7b2336b80d8f64c08b25a462995971254ab143bf1ea94a7c4560714375da4b7830389eeebefdb549805c894b54f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat

Filesize
220B

MD5
9eba244619be6e85892d4d58ed18cff3

SHA1
a3c63b06f0d97513e775f238d99bdd4fd39d823b

SHA256
a9199612e8bda26426a720e42b5c24066176d5333c42c525c6ada982f670cd79

SHA512
baf03aa6dce6150c8b2d0f175009b30c7dffad7350689b852b5d742505d530af10bda1c00faabe382a913ce052a959895bfa1e2b82b36fe0064ee619efea237f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

Filesize
220B

MD5
e33df29af5220985c167f8e3a8316b9a

SHA1
a1a2c9acd2fcd724e17ce1ab8abc76176a8c9e39

SHA256
2a6159cd15946fd8c536c056b9fc48bb92d71781d8226f5ff9132b1b4c80b37f

SHA512
73fb650eecda010518abd99aa30e76624cacb94353c8e89e700ed873b5cc261034949ff524a70e65569f818782f11948054f2cabd06e32da1407f6ddf3711547

Download Submit
C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat

Filesize
220B

MD5
0813fef861ff7cf75054beba1083187f

SHA1
fc25dc45d68cd59ee7bdc57b63b8ba7f06c76702

SHA256
c1bbf9b1ea5499362113118e0a513b9af50a93a8fd1977109d789a1c49a5a0a2

SHA512
61836a4dfdf00fb5d9d3e544ed8e3b2259b558a76a837fc5032e8f4853c5f71a2b6dfac42ae1bc9017e86d7e2a95a8b2cd8696524795244bef905147158708ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat

Filesize
220B

MD5
cb54546e770fa8d4141f49c29d0ac9e0

SHA1
29d501b133eece5a1cf57a468990a860f00618ca

SHA256
62f88c06d1a98f881f9beb6cd00145a1294c118cb61347290a7b595252c0c97c

SHA512
12496d3d76610d514aaf44d2c986e229178081b8aa19d541f4a036bb37c58ed40fc681a51494f79d6755b6d8b9595e1b062c31bedf663595bcbfefa35d5a032f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat

Filesize
220B

MD5
b070508672263c91d328499b8979af75

SHA1
99e5eabda0c754a93ee0a4697f690a9b55c9c0b3

SHA256
1d68c5b6fb3364689e8fd212b351053c7a23f411ab780840ad11fe88462a3c04

SHA512
156775dee6095a5cc42c3e963dd29764046b44ed229cffcfc31a7acbed5b5d3ce8b77d12f1c50b17718137b6af7336ed4dac88533cdf5c744ba3c648e94093e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

Filesize
220B

MD5
bbec7fb9e0d651c5016c4aed95229122

SHA1
889b7244bf1499089522e38afe1d33d4a0d77717

SHA256
a732d3bb6f6c975e14ff0ecd42973e7c15d3f38c852e8567ffd97b16fe540166

SHA512
813f46047e1f531ac64e7717635122e3c15594e8e81da543ae2b88ac491a6f1aaa5afc7dda2407de0fcf641e9b42ab187f2931060ba0909a975e3eacdb754641

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/864-290-0x0000000001040000-0x0000000001052000-memory.dmp

Filesize
72KB

Download
memory/1432-13-0x0000000000160000-0x0000000000270000-memory.dmp

Filesize
1.1MB

Download
memory/1432-14-0x00000000021E0000-0x00000000021F2000-memory.dmp

Filesize
72KB

Download
memory/1432-15-0x0000000002320000-0x000000000232C000-memory.dmp

Filesize
48KB

Download
memory/1432-16-0x0000000002300000-0x000000000230C000-memory.dmp

Filesize
48KB

Download
memory/1432-17-0x0000000002310000-0x000000000231C000-memory.dmp

Filesize
48KB

Download
memory/1432-12-0x00007FFFF2E23000-0x00007FFFF2E25000-memory.dmp

Filesize
8KB

Download
memory/1564-342-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2536-78-0x0000000000CC0000-0x0000000000CD2000-memory.dmp

Filesize
72KB

Download
memory/3848-242-0x0000000002C10000-0x0000000002C22000-memory.dmp

Filesize
72KB

Download
memory/3980-349-0x0000000000F20000-0x0000000000F32000-memory.dmp

Filesize
72KB

Download
memory/4564-34-0x00000214BC5F0000-0x00000214BC612000-memory.dmp

Filesize
136KB

Download
memory/5316-321-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/5556-328-0x0000000002E70000-0x0000000002E82000-memory.dmp

Filesize
72KB

Download
memory/5988-335-0x00000000011D0000-0x00000000011E2000-memory.dmp

Filesize
72KB

Download