dcrat | 964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe
Size

1.3MB
MD5

3bbd16819c19a3cb052cbfe45d628e43
SHA1

d776489d05323fa6fb7c2f029d3e577e65b7873c
SHA256

964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e
SHA512

94b7a1c5f4b6695c53b6c369a9b7037d895c0e54e73613eea7b77f44a482c4e9e83f718d0ca2b04bacc1ac8b106d2efe9bcce07f770d5d8e900639de72b9bfaa
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1632	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	1632	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000019268-12.dat	dcrat
behavioral1/memory/2772-13-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/864-60-0x0000000000D60000-0x0000000000E70000-memory.dmp	dcrat
behavioral1/memory/920-216-0x0000000000E90000-0x0000000000FA0000-memory.dmp	dcrat
behavioral1/memory/2844-396-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat
behavioral1/memory/920-457-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/2916-517-0x0000000000A90000-0x0000000000BA0000-memory.dmp	dcrat
behavioral1/memory/1460-577-0x0000000001020000-0x0000000001130000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1284	powershell.exe
2880	powershell.exe
2692	powershell.exe
2764	powershell.exe
2600	powershell.exe
2648	powershell.exe
900	powershell.exe
2796	powershell.exe
2920	powershell.exe
2628	powershell.exe
3044	powershell.exe
2124	powershell.exe
2968	powershell.exe
2852	powershell.exe
2788	powershell.exe
2588	powershell.exe
2596	powershell.exe
2488	powershell.exe
2452	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2772	DllCommonsvc.exe
864	Idle.exe
920	Idle.exe
2916	Idle.exe
1048	Idle.exe
2844	Idle.exe
920	Idle.exe
2916	Idle.exe
1460	Idle.exe
1720	Idle.exe
2880	Idle.exe
1600	Idle.exe

Loads dropped DLL 2 IoCs

pid	Process
2840	cmd.exe
2840	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
32	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
22	raw.githubusercontent.com
29	raw.githubusercontent.com
35	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
25	raw.githubusercontent.com

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\en-US\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\en-US\csrss.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Internet Explorer\images\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PolicyDefinitions\en-US\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\en-US\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\IME\it-IT\smss.exe	DllCommonsvc.exe
File created	C:\Windows\IME\it-IT\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
272	schtasks.exe
2252	schtasks.exe
1964	schtasks.exe
2776	schtasks.exe
1372	schtasks.exe
1020	schtasks.exe
3004	schtasks.exe
2364	schtasks.exe
2316	schtasks.exe
1992	schtasks.exe
1048	schtasks.exe
2732	schtasks.exe
2756	schtasks.exe
2636	schtasks.exe
2304	schtasks.exe
1540	schtasks.exe
2236	schtasks.exe
1728	schtasks.exe
1012	schtasks.exe
2892	schtasks.exe
2416	schtasks.exe
2140	schtasks.exe
2116	schtasks.exe
1624	schtasks.exe
1672	schtasks.exe
2280	schtasks.exe
692	schtasks.exe
1608	schtasks.exe
2104	schtasks.exe
2024	schtasks.exe
2904	schtasks.exe
2288	schtasks.exe
2564	schtasks.exe
2924	schtasks.exe
2992	schtasks.exe
716	schtasks.exe
712	schtasks.exe
3060	schtasks.exe
1260	schtasks.exe
2376	schtasks.exe
1576	schtasks.exe
2148	schtasks.exe
1564	schtasks.exe
2004	schtasks.exe
2020	schtasks.exe
1460	schtasks.exe
1768	schtasks.exe
2744	schtasks.exe
2388	schtasks.exe
340	schtasks.exe
2556	schtasks.exe
2260	schtasks.exe
2060	schtasks.exe
304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2764	powershell.exe
2852	powershell.exe
2692	powershell.exe
864	Idle.exe
2920	powershell.exe
2596	powershell.exe
2968	powershell.exe
1284	powershell.exe
2796	powershell.exe
2648	powershell.exe
2452	powershell.exe
2124	powershell.exe
2600	powershell.exe
2880	powershell.exe
2588	powershell.exe
2488	powershell.exe
2628	powershell.exe
900	powershell.exe
3044	powershell.exe
2788	powershell.exe
920	Idle.exe
2916	Idle.exe
1048	Idle.exe
2844	Idle.exe
920	Idle.exe
2916	Idle.exe
1460	Idle.exe
1720	Idle.exe
2880	Idle.exe
1600	Idle.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	DllCommonsvc.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	864	Idle.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	920	Idle.exe
Token: SeDebugPrivilege	2916	Idle.exe
Token: SeDebugPrivilege	1048	Idle.exe
Token: SeDebugPrivilege	2844	Idle.exe
Token: SeDebugPrivilege	920	Idle.exe
Token: SeDebugPrivilege	2916	Idle.exe
Token: SeDebugPrivilege	1460	Idle.exe
Token: SeDebugPrivilege	1720	Idle.exe
Token: SeDebugPrivilege	2880	Idle.exe
Token: SeDebugPrivilege	1600	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2788	2168	JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe	30
PID 2168 wrote to memory of 2788	2168	JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe	30
PID 2168 wrote to memory of 2788	2168	JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe	30
PID 2168 wrote to memory of 2788	2168	JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe	30
PID 2788 wrote to memory of 2840	2788	WScript.exe	31
PID 2788 wrote to memory of 2840	2788	WScript.exe	31
PID 2788 wrote to memory of 2840	2788	WScript.exe	31
PID 2788 wrote to memory of 2840	2788	WScript.exe	31
PID 2840 wrote to memory of 2772	2840	cmd.exe	33
PID 2840 wrote to memory of 2772	2840	cmd.exe	33
PID 2840 wrote to memory of 2772	2840	cmd.exe	33
PID 2840 wrote to memory of 2772	2840	cmd.exe	33
PID 2772 wrote to memory of 2852	2772	DllCommonsvc.exe	89
PID 2772 wrote to memory of 2852	2772	DllCommonsvc.exe	89
PID 2772 wrote to memory of 2852	2772	DllCommonsvc.exe	89
PID 2772 wrote to memory of 2796	2772	DllCommonsvc.exe	90
PID 2772 wrote to memory of 2796	2772	DllCommonsvc.exe	90
PID 2772 wrote to memory of 2796	2772	DllCommonsvc.exe	90
PID 2772 wrote to memory of 2692	2772	DllCommonsvc.exe	91
PID 2772 wrote to memory of 2692	2772	DllCommonsvc.exe	91
PID 2772 wrote to memory of 2692	2772	DllCommonsvc.exe	91
PID 2772 wrote to memory of 2788	2772	DllCommonsvc.exe	92
PID 2772 wrote to memory of 2788	2772	DllCommonsvc.exe	92
PID 2772 wrote to memory of 2788	2772	DllCommonsvc.exe	92
PID 2772 wrote to memory of 2764	2772	DllCommonsvc.exe	93
PID 2772 wrote to memory of 2764	2772	DllCommonsvc.exe	93
PID 2772 wrote to memory of 2764	2772	DllCommonsvc.exe	93
PID 2772 wrote to memory of 2600	2772	DllCommonsvc.exe	94
PID 2772 wrote to memory of 2600	2772	DllCommonsvc.exe	94
PID 2772 wrote to memory of 2600	2772	DllCommonsvc.exe	94
PID 2772 wrote to memory of 2920	2772	DllCommonsvc.exe	95
PID 2772 wrote to memory of 2920	2772	DllCommonsvc.exe	95
PID 2772 wrote to memory of 2920	2772	DllCommonsvc.exe	95
PID 2772 wrote to memory of 2588	2772	DllCommonsvc.exe	96
PID 2772 wrote to memory of 2588	2772	DllCommonsvc.exe	96
PID 2772 wrote to memory of 2588	2772	DllCommonsvc.exe	96
PID 2772 wrote to memory of 2596	2772	DllCommonsvc.exe	97
PID 2772 wrote to memory of 2596	2772	DllCommonsvc.exe	97
PID 2772 wrote to memory of 2596	2772	DllCommonsvc.exe	97
PID 2772 wrote to memory of 2628	2772	DllCommonsvc.exe	98
PID 2772 wrote to memory of 2628	2772	DllCommonsvc.exe	98
PID 2772 wrote to memory of 2628	2772	DllCommonsvc.exe	98
PID 2772 wrote to memory of 2648	2772	DllCommonsvc.exe	99
PID 2772 wrote to memory of 2648	2772	DllCommonsvc.exe	99
PID 2772 wrote to memory of 2648	2772	DllCommonsvc.exe	99
PID 2772 wrote to memory of 3044	2772	DllCommonsvc.exe	100
PID 2772 wrote to memory of 3044	2772	DllCommonsvc.exe	100
PID 2772 wrote to memory of 3044	2772	DllCommonsvc.exe	100
PID 2772 wrote to memory of 900	2772	DllCommonsvc.exe	101
PID 2772 wrote to memory of 900	2772	DllCommonsvc.exe	101
PID 2772 wrote to memory of 900	2772	DllCommonsvc.exe	101
PID 2772 wrote to memory of 2488	2772	DllCommonsvc.exe	102
PID 2772 wrote to memory of 2488	2772	DllCommonsvc.exe	102
PID 2772 wrote to memory of 2488	2772	DllCommonsvc.exe	102
PID 2772 wrote to memory of 1284	2772	DllCommonsvc.exe	103
PID 2772 wrote to memory of 1284	2772	DllCommonsvc.exe	103
PID 2772 wrote to memory of 1284	2772	DllCommonsvc.exe	103
PID 2772 wrote to memory of 2452	2772	DllCommonsvc.exe	104
PID 2772 wrote to memory of 2452	2772	DllCommonsvc.exe	104
PID 2772 wrote to memory of 2452	2772	DllCommonsvc.exe	104
PID 2772 wrote to memory of 2124	2772	DllCommonsvc.exe	105
PID 2772 wrote to memory of 2124	2772	DllCommonsvc.exe	105
PID 2772 wrote to memory of 2124	2772	DllCommonsvc.exe	105
PID 2772 wrote to memory of 2880	2772	DllCommonsvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_964a52ad9b462abc5adaf472b7550f1aa449c92fd38af7b7e4703d55d9cc1a8e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\en-US\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\it-IT\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tcsv1v0qfT.bat"
        6⤵
        
        PID:2944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1944
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"
        8⤵
        
        PID:1276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2152
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat"
        10⤵
        
        PID:2392
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1616
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"
        12⤵
        
        PID:2420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2140
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsSi1KDKJG.bat"
        14⤵
        
        PID:2724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2360
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat"
        16⤵
        
        PID:1984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2104
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zY3yp8Lh1n.bat"
        18⤵
        
        PID:2604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2476
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        20⤵
        
        PID:2716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3036
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat"
        22⤵
        
        PID:2588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2052
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat"
        24⤵
        
        PID:2460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1928
        
        C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe
        
        "C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\images\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Windows\PolicyDefinitions\en-US\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\en-US\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\it-IT\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\IME\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Start Menu\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f5d6c85f097baf35fc8f9f82a87ad50

SHA1
a94a5dc1e4a627c68f5a7a7df424b6c4ccbb8b53

SHA256
1301df206a47f6544b6118e93ec50203420670682427657a8ba0057d1767614b

SHA512
934f0b7575f489a7db3b3d620a9d9c95914fea8dcd5ec1e00cb1d09c1eafa041c774c1cca2cb60140ee06bcfdbcd3eaedec052b0774250f09157366e88e06d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34b866d7e8c886e75d54b0ddd8eb179f

SHA1
b015aabbb3bf36e65adb01b86df3403e03455799

SHA256
6fb0b4c07fad2205d17de53cec9bb61046bf05bb3401ce7f9239f6636beed31e

SHA512
c641e37b96db0608f02f447836a9fcf9cfa9b547fdb8a44b1606dba544009547dcdabe3968fdcba6146be52848a7e4d67d30bb63691ef31f2cd15c1cf8854f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fc7babd9cb0033f3ba7eb8859dd4e6a

SHA1
726bb2465f0ee59dfb0d716493c2555851ea6a8c

SHA256
b01a9efa11329115b7a05629f9066e4e806cd6cf78d384e1a891536fc5b80425

SHA512
787635ec667a5fd015c6ab3368e8052b0803a6af6af66c109239ce70b4bdc1821e35f9c910bc3fbfc9927f3920faf4577141afc0c37980a195b37ade792cf7b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f0bbfd061693791f328f5ccf7d412f9

SHA1
b4175a94580344e261754e47f80762ab9cc2b49b

SHA256
ff7753384342d4c64833a06ae96daedc0145156366ce438f69b6c8684673d862

SHA512
d33f280a0d5471f33348637d4588287b64046f56cab9df6ab99e10bd2030b963a86a530d80f4fb546e337eb3d3f3032174c55e64a09d98229de61c35aebd72e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
796662763201de0719498d7b7a75fe25

SHA1
4dc49e7a66bfa2de438fc5f645fe92aeff977406

SHA256
c00c7ff9c73c6cf41cd51e841a082eb7aa6fdf147d7f3c650a369059ca580a37

SHA512
97f33b66334cf6bd37d87099d813f0a18c0a501dd2d109dbd648899d8d50a293e22d3847d2085c77ff7c941e6f43abe58c0aa856e057e8750c2e98697e08f736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf4894deebb1e10ec1e7cfa6968d6a6

SHA1
c547923f064dc16e0109db90ee2609c4aad03f43

SHA256
c761a835b80b07f031e65b17a211165950d6461cd7219f20107d978b841934c9

SHA512
8850860300f68321646c4dbae85d1cff25b414194b0ad0ff2422f3defeb97bc64258ff681e2b1d098d3ff650216b7002137c3b3f9e6806eed44b5974edc1e2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09d95e0cf83ea5e625cfbe38f8459139

SHA1
7e40cd506c01f37ca4d6832dd78b2275c18d6ffa

SHA256
6325b2df4bea3594f956271aebba2cb091f1eb4091e21d1967e841267436c556

SHA512
0cd016dbec33955ff3afc27bf13cf4f3239772259c179ba6267ab63ddce04b2a6bda2c224de4936c955fc8cef1bb11a0e3aa0afc46695a347247225131252ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60050fa4b7030a0db42c50a8e990d705

SHA1
c43553c849cdfb964e0f57412d5b2895dc9e8a3a

SHA256
f3f1f36f528d106d3f5d061d571223321992ee237e4b8cc64e74bb2205d47703

SHA512
d6704306672e0d1e1418f35bd86682d0707948bd41a5b83bcccaf6c8e62e2149365a56a79bae531b8fa208ce27410fcc54d2a873c9dd72e62b04053f0ca65d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e4730b635a4ab7fe137f18fb67119bf

SHA1
1e4e1e1d46bce6628c37584cc7bc4d2edd28cd07

SHA256
4b83068fc3600ad611ba5f1fbcf8fccdb144e25536a2817b6099e98670822bae

SHA512
7e5caeb43d462a41f382007d4e1e6a0ff65b4a962bea4757250a761db6b82d31d966cdf3d2e128d2f3613f8d49097b7a577d89c533771c3138cff5cbc68f4d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat

Filesize
232B

MD5
3f9ea60ddaa9980de03693b89b8ff62c

SHA1
f4e2d0945dea754f70a1c1c16d2ec4dcb54ad38d

SHA256
b20f4ede5e70517c186d06883c23157459ff7d164f1db8f2ef7e343e42956217

SHA512
5a89bb11c4eca537d198b1f126e45d845f9ae71fa399771145ada892cf1852c31c465dbfb8ca073e2f9503441736a8b1c20b77711681bd9e6d6f834c00d725ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat

Filesize
232B

MD5
7479fc8e4420a2ff480380f34c8fd920

SHA1
4318925ff525dbea73c98f8fc8493c1777cd662e

SHA256
6bf56f99cd1e8f49af8876460a6eab8ab6fb6316b96cc3d898ddd7fc34cd18c6

SHA512
34a3f2d3e18105acc2386198f6b31a54c9b116ca5084067bc10e73d451f85f049b93971eee704cabe006863ea1853a36d2fa24507e3dd2bd87384bf07927c0fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab73BB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat

Filesize
232B

MD5
249573fd6058b9361ffbb98189030615

SHA1
f7faaa92e8d01ef2f8a7fda50a3cf9b93fb1d20c

SHA256
5b5878ccc50a76b29ad0b0d03bdc9ee80c638764f07cec495cce6ed35ff35f38

SHA512
1272f3139346c1be6e0381885b6db971f288b3f3f0f019abb4bf7cbb08b6c0668031f7468387ce4e6b367306d3c129463513cda9f904cc1243cc841e626ff5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsSi1KDKJG.bat

Filesize
232B

MD5
a0bdc8c4daaf84e4e88d2be5e6fdf608

SHA1
b2981e43449ac1aaa38d2d5528bb998636ff4108

SHA256
5bcb10c4b826f4cd7769c1cfadf469cedf87a6a7ed402e3723e86c681425fc1a

SHA512
aeac6d7d6723cc474952a98b0a7d60616fffd7b6cd8e856f4a7bb6fc2a7c30a7e9d73f470fdc4d56136da681238c492c7b621a5487bf779a1841effbabdf5ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat

Filesize
232B

MD5
2d02b1aced411b989e8e271eac848a55

SHA1
afbb4b3fcc1932a4b332c392dac69871042b3e62

SHA256
633c560abbe1de6450bee715e681e92b31712715e1be82cbddfbf1afcee565fe

SHA512
f1ce1006cb34599ff2cb6ac881878c6df1996d8572862b113c3c1cef7e65df3909315612370c2e52a223cfe33ba34b92c0d5160dff49ac2ace16a679f6d8b453

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73CE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tcsv1v0qfT.bat

Filesize
232B

MD5
3ee93f69ae2a91c64062c411e6770ab7

SHA1
98bca4f118ece459797c4ed1c9a29b4ea065dace

SHA256
4597f1f287823126da23c29f8fb13624535c482c8212737ac93cf30c94536f8d

SHA512
7b2e556e8bcb594b381db30a94396bf09a2e6a19be3e64b0bb13c70cccaeda6d148fdc6ee59310f5db1d1b27e3177bd65b3e728fa01ac8e9243224eb2a1063fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat

Filesize
232B

MD5
b36c745d00c2235ccee0b397706bc052

SHA1
85a0f7e86c8f0ed780427165f11355616e0aac06

SHA256
6aa6a21979df16ac23fe9a15533a3f72b55f3d4590e08525e4567cb04b99a622

SHA512
f8eb9668f9f213a4c70ae3ab5366eb017b9b82fbb5f7aeef55314451e59d17908e4f3c2f5e227cc0cdcf081d24363b33fa08be820f250f52e1d725651f8dbe96

Download Submit
C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat

Filesize
232B

MD5
2a66696a5c9a35cb3dd781b09dcafb32

SHA1
577f16824607a06e42b63d29e957c9840466fd68

SHA256
a6bcbc7c261527686ec2ddaf2c0e2f55db7578ce7c11b5169ce449909efe7a67

SHA512
b0482caa7813786874df273e58e5e357ebe60abfbc6660dc7f0659876f38680c909276214ba8487568858d1d4198fa7349b08c46e9a51117d96d96da051b3afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat

Filesize
232B

MD5
98065b30cec2ef18e0093ab24074e47a

SHA1
593f172bace5ec4c0507b2ab00280e83a8256a98

SHA256
0774b2aa409b7b35177afaee91663c6c8aea91922963bcd3c3c66dd3830ef396

SHA512
e30c2e34d51604533f3ad59f896aff5f97e740a0dd768cc4e3c69ac599ed03053d62eb5846081a4f8756b0e6d908743515429c446992e7fc3fedf7304f2b2650

Download Submit
C:\Users\Admin\AppData\Local\Temp\zY3yp8Lh1n.bat

Filesize
232B

MD5
a2804e6eeba9aa58103316bcb411bb48

SHA1
7f0e2a4fd2e7b51a6f2e76e9cf0b7a3cfb39495e

SHA256
eec5afc9e61dd85e09239a72379802435ad74a2105f8ffadb7d2eade64eff9ec

SHA512
81530ea31c9fc5564bc91ec538c75a5abedd99a53dfb3850e788e22af1d7693edad3254707f46b725b626b259d4c48b0077f68cf8dd829ffcb6240404998aed2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7dd06db8036b7a58e7b28e75b7084343

SHA1
15a96baca1279645e5afc0e6494d869dcb981429

SHA256
613ea9ce5e08297216a1970d2b920ca636f7b9f1d3ed7a4b89385f3025c2e209

SHA512
b4b78615b201fcad438916f6f9e1462c63f4a4bbffc7e304d835e17fece370b92cc30d29675aacc6e028c5b5a5c06829c76e76285fb2c5e2e5619f9d15c468c3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/864-60-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/864-77-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/920-217-0x0000000000570000-0x0000000000582000-memory.dmp

Filesize
72KB

Download
memory/920-216-0x0000000000E90000-0x0000000000FA0000-memory.dmp

Filesize
1.1MB

Download
memory/920-457-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/1460-577-0x0000000001020000-0x0000000001130000-memory.dmp

Filesize
1.1MB

Download
memory/2764-72-0x0000000001F10000-0x0000000001F18000-memory.dmp

Filesize
32KB

Download
memory/2764-71-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2772-17-0x0000000000650000-0x000000000065C000-memory.dmp

Filesize
48KB

Download
memory/2772-16-0x000000001AE00000-0x000000001AE0C000-memory.dmp

Filesize
48KB

Download
memory/2772-15-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/2772-14-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2772-13-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2844-397-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2844-396-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download
memory/2916-517-0x0000000000A90000-0x0000000000BA0000-memory.dmp

Filesize
1.1MB

Download
memory/2916-277-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download