dcrat | d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe
Size

1.3MB
MD5

22b5386965221419ce4b6af9b65d9728
SHA1

581ab2e07f60144ee633a83934f123f6dc50df60
SHA256

d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d
SHA512

8231517967440c1171994a7ada1ab17bc4a2dbc56aba9d0cfc0f5b6dd53dba93dba5fb777c5ce32b31cdbcfc98470b81f304f9395a262ec906abb4a0916c73c6
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	460	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2892	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2892	schtasks.exe	35

DCRat payload 12 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016858-9.dat	dcrat
behavioral1/memory/2756-13-0x0000000001020000-0x0000000001130000-memory.dmp	dcrat
behavioral1/memory/904-159-0x0000000000210000-0x0000000000320000-memory.dmp	dcrat
behavioral1/memory/2784-171-0x0000000000850000-0x0000000000960000-memory.dmp	dcrat
behavioral1/memory/1244-240-0x0000000000B50000-0x0000000000C60000-memory.dmp	dcrat
behavioral1/memory/2580-359-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/2300-479-0x00000000003C0000-0x00000000004D0000-memory.dmp	dcrat
behavioral1/memory/2820-539-0x00000000001E0000-0x00000000002F0000-memory.dmp	dcrat
behavioral1/memory/1904-599-0x0000000000C90000-0x0000000000DA0000-memory.dmp	dcrat
behavioral1/memory/2488-659-0x0000000000090000-0x00000000001A0000-memory.dmp	dcrat
behavioral1/memory/296-719-0x0000000000D60000-0x0000000000E70000-memory.dmp	dcrat
behavioral1/memory/2836-780-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1588	powershell.exe
1224	powershell.exe
1804	powershell.exe
952	powershell.exe
696	powershell.exe
1432	powershell.exe
2524	powershell.exe
1592	powershell.exe
2032	powershell.exe
1936	powershell.exe
904	powershell.exe
1268	powershell.exe
2068	powershell.exe
2008	powershell.exe
2364	powershell.exe
1852	powershell.exe
1576	powershell.exe
1340	powershell.exe
840	powershell.exe
1808	powershell.exe
2360	powershell.exe
1624	powershell.exe
2304	powershell.exe
1580	powershell.exe
2004	powershell.exe

Executes dropped EXE 31 IoCs

pid	Process
2756	DllCommonsvc.exe
2472	DllCommonsvc.exe
904	powershell.exe
1804	powershell.exe
1268	powershell.exe
1224	powershell.exe
2524	powershell.exe
2784	powershell.exe
2304	powershell.exe
1432	powershell.exe
2360	powershell.exe
1580	powershell.exe
952	powershell.exe
2364	powershell.exe
2068	powershell.exe
2008	powershell.exe
1808	powershell.exe
1576	powershell.exe
840	powershell.exe
696	powershell.exe
1340	powershell.exe
1244	powershell.exe
2980	powershell.exe
2580	powershell.exe
2396	powershell.exe
2300	powershell.exe
2820	powershell.exe
1904	powershell.exe
2488	powershell.exe
296	powershell.exe
2836	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
264	cmd.exe
264	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\en-US\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\en-US\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Services\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\Services\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\System.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\servicing\ja-JP\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\schemas\AvailableNetwork\powershell.exe	DllCommonsvc.exe
File created	C:\Windows\schemas\AvailableNetwork\e978f868350d50	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2400	schtasks.exe
2664	schtasks.exe
1848	schtasks.exe
1916	schtasks.exe
1596	schtasks.exe
2948	schtasks.exe
1928	schtasks.exe
1696	schtasks.exe
1576	schtasks.exe
3020	schtasks.exe
2728	schtasks.exe
1928	schtasks.exe
2300	schtasks.exe
1140	schtasks.exe
2096	schtasks.exe
2864	schtasks.exe
604	schtasks.exe
1060	schtasks.exe
776	schtasks.exe
1108	schtasks.exe
2528	schtasks.exe
1756	schtasks.exe
2412	schtasks.exe
1624	schtasks.exe
2612	schtasks.exe
2636	schtasks.exe
2644	schtasks.exe
2988	schtasks.exe
1948	schtasks.exe
2284	schtasks.exe
1908	schtasks.exe
1708	schtasks.exe
2752	schtasks.exe
1380	schtasks.exe
1672	schtasks.exe
2620	schtasks.exe
2896	schtasks.exe
1600	schtasks.exe
2792	schtasks.exe
1356	schtasks.exe
2596	schtasks.exe
896	schtasks.exe
2556	schtasks.exe
1552	schtasks.exe
632	schtasks.exe
1072	schtasks.exe
2516	schtasks.exe
2316	schtasks.exe
1736	schtasks.exe
1368	schtasks.exe
2364	schtasks.exe
2536	schtasks.exe
1924	schtasks.exe
836	schtasks.exe
2000	schtasks.exe
2552	schtasks.exe
2788	schtasks.exe
1108	schtasks.exe
2624	schtasks.exe
264	schtasks.exe
2520	schtasks.exe
2720	schtasks.exe
2356	schtasks.exe
1092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2756	DllCommonsvc.exe
2756	DllCommonsvc.exe
2756	DllCommonsvc.exe
1936	powershell.exe
1624	powershell.exe
2032	powershell.exe
2004	powershell.exe
1852	powershell.exe
1588	powershell.exe
1592	powershell.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
2472	DllCommonsvc.exe
904	powershell.exe
1244	powershell.exe
2980	powershell.exe
2580	powershell.exe
2396	powershell.exe
2300	powershell.exe
2820	powershell.exe
1904	powershell.exe
2488	powershell.exe
296	powershell.exe
2836	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	DllCommonsvc.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	2472	DllCommonsvc.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2544	2212	JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe	30
PID 2212 wrote to memory of 2544	2212	JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe	30
PID 2212 wrote to memory of 2544	2212	JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe	30
PID 2212 wrote to memory of 2544	2212	JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe	30
PID 2544 wrote to memory of 264	2544	WScript.exe	32
PID 2544 wrote to memory of 264	2544	WScript.exe	32
PID 2544 wrote to memory of 264	2544	WScript.exe	32
PID 2544 wrote to memory of 264	2544	WScript.exe	32
PID 264 wrote to memory of 2756	264	cmd.exe	34
PID 264 wrote to memory of 2756	264	cmd.exe	34
PID 264 wrote to memory of 2756	264	cmd.exe	34
PID 264 wrote to memory of 2756	264	cmd.exe	34
PID 2756 wrote to memory of 1624	2756	DllCommonsvc.exe	54
PID 2756 wrote to memory of 1624	2756	DllCommonsvc.exe	54
PID 2756 wrote to memory of 1624	2756	DllCommonsvc.exe	54
PID 2756 wrote to memory of 1592	2756	DllCommonsvc.exe	55
PID 2756 wrote to memory of 1592	2756	DllCommonsvc.exe	55
PID 2756 wrote to memory of 1592	2756	DllCommonsvc.exe	55
PID 2756 wrote to memory of 1588	2756	DllCommonsvc.exe	56
PID 2756 wrote to memory of 1588	2756	DllCommonsvc.exe	56
PID 2756 wrote to memory of 1588	2756	DllCommonsvc.exe	56
PID 2756 wrote to memory of 1852	2756	DllCommonsvc.exe	57
PID 2756 wrote to memory of 1852	2756	DllCommonsvc.exe	57
PID 2756 wrote to memory of 1852	2756	DllCommonsvc.exe	57
PID 2756 wrote to memory of 2032	2756	DllCommonsvc.exe	58
PID 2756 wrote to memory of 2032	2756	DllCommonsvc.exe	58
PID 2756 wrote to memory of 2032	2756	DllCommonsvc.exe	58
PID 2756 wrote to memory of 1936	2756	DllCommonsvc.exe	59
PID 2756 wrote to memory of 1936	2756	DllCommonsvc.exe	59
PID 2756 wrote to memory of 1936	2756	DllCommonsvc.exe	59
PID 2756 wrote to memory of 2004	2756	DllCommonsvc.exe	60
PID 2756 wrote to memory of 2004	2756	DllCommonsvc.exe	60
PID 2756 wrote to memory of 2004	2756	DllCommonsvc.exe	60
PID 2756 wrote to memory of 2472	2756	DllCommonsvc.exe	68
PID 2756 wrote to memory of 2472	2756	DllCommonsvc.exe	68
PID 2756 wrote to memory of 2472	2756	DllCommonsvc.exe	68
PID 2472 wrote to memory of 904	2472	DllCommonsvc.exe	120
PID 2472 wrote to memory of 904	2472	DllCommonsvc.exe	120
PID 2472 wrote to memory of 904	2472	DllCommonsvc.exe	120
PID 2472 wrote to memory of 1224	2472	DllCommonsvc.exe	121
PID 2472 wrote to memory of 1224	2472	DllCommonsvc.exe	121
PID 2472 wrote to memory of 1224	2472	DllCommonsvc.exe	121
PID 2472 wrote to memory of 1804	2472	DllCommonsvc.exe	122
PID 2472 wrote to memory of 1804	2472	DllCommonsvc.exe	122
PID 2472 wrote to memory of 1804	2472	DllCommonsvc.exe	122
PID 2472 wrote to memory of 2524	2472	DllCommonsvc.exe	123
PID 2472 wrote to memory of 2524	2472	DllCommonsvc.exe	123
PID 2472 wrote to memory of 2524	2472	DllCommonsvc.exe	123
PID 2472 wrote to memory of 1268	2472	DllCommonsvc.exe	124
PID 2472 wrote to memory of 1268	2472	DllCommonsvc.exe	124
PID 2472 wrote to memory of 1268	2472	DllCommonsvc.exe	124
PID 2472 wrote to memory of 1808	2472	DllCommonsvc.exe	125
PID 2472 wrote to memory of 1808	2472	DllCommonsvc.exe	125
PID 2472 wrote to memory of 1808	2472	DllCommonsvc.exe	125
PID 2472 wrote to memory of 1432	2472	DllCommonsvc.exe	126
PID 2472 wrote to memory of 1432	2472	DllCommonsvc.exe	126
PID 2472 wrote to memory of 1432	2472	DllCommonsvc.exe	126
PID 2472 wrote to memory of 2008	2472	DllCommonsvc.exe	127
PID 2472 wrote to memory of 2008	2472	DllCommonsvc.exe	127
PID 2472 wrote to memory of 2008	2472	DllCommonsvc.exe	127
PID 2472 wrote to memory of 2304	2472	DllCommonsvc.exe	128
PID 2472 wrote to memory of 2304	2472	DllCommonsvc.exe	128
PID 2472 wrote to memory of 2304	2472	DllCommonsvc.exe	128
PID 2472 wrote to memory of 2068	2472	DllCommonsvc.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d729ac6ea78f2729e27c9709b9de68171434a9cbf3ec67b8d95565ed9cc6ac3d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\de-DE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2472
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
        7⤵
        
        PID:1532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2392
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat"
        9⤵
        
        PID:1584
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2288
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat"
        11⤵
        
        PID:624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2228
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat"
        13⤵
        
        PID:2060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1556
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tcplHXgq9Q.bat"
        15⤵
        
        PID:1336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2872
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0uTXzTWsAa.bat"
        17⤵
        
        PID:1840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2660
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat"
        19⤵
        
        PID:1064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1696
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat"
        21⤵
        
        PID:2056
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2304
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UTkrWZWekQ.bat"
        23⤵
        
        PID:2164
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2808
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"
        25⤵
        
        PID:2936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1156
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\Roaming\Media Center Programs\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\en-US\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\AvailableNetwork\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\audiodg.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Services\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
      - C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\powershell.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\powershell.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jdk1.7.0_80\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk1.7.0_80\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\de-DE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Users\Default\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Default\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Users\Default\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\AppData\Roaming\Media Center Programs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\AppData\Roaming\Media Center Programs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\AppData\Roaming\Media Center Programs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Windows\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\providercommon\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\en-US\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\en-US\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\Services\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\Services\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43143dc57806adee2af72469bef352f2

SHA1
98257b2af108aa4a20fdb4b3c368e9c43638a9a8

SHA256
f5713d153b9e24d5fdbfd0c378063f58a65bf86c1826069c06fb700b9777ba22

SHA512
5adbe55aadfe65d07b8473b0ff8399d606f15700c3acc1eccba7f21c3b967b96c1949d99c1e40127ee58d32539d347521466a4b3992048cd1f0ef09e9141aabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9266c956cdc82a64c85c693dc7df9d3

SHA1
9af12da528f8e4f2cfb64be9c15b7b76fdec9176

SHA256
f9c12d9f56334e7f01d0ae5658f77f490b600dbbef16cc4c358885deb0974d04

SHA512
a9204ae4199f18b12141f36186c5c2deff8858620175fb2017ff8da6efb763a63452649410580261ea0d3c55010c5c5af879de0260f3b0aec476bd47e10f5eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11944595a54bb75b1c284ab012bca09d

SHA1
0410dd52f9ff07610c450f145c43ba0e9be27af6

SHA256
57604087ae0508a6b0958308a45e4b175f99e26c740d2de946ae2509f0a410f9

SHA512
f8561899d1f833e073d462ca258c8b1b22c045efdc5feb7daace75ecf7e28bcda5cdf1af8ffbd4a394eefb372362dbdbad0eb323bf36770491d828393811ea2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b71a3ec55a814ae43ec15ae8f974376a

SHA1
a27be031c861598433a83b6806c298c29b727bea

SHA256
f1f3ee0e8332ce95b6d1eb659a7ac642c7dd5515438627da1010a508ff50bf7d

SHA512
e61f370f52ef7976dffebcb6a07270417bc0f92b3b2043c404ab3072e0187eef776199b35691228d03f81a2e0d59772ecf5e5c1d8d1bd356260d387a9e709f1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aecba834a565980c9cfe8f53ecfd82d

SHA1
3db9dbbf68746203ad5c988fd54728c95a27a67e

SHA256
2eed708d30378278afe07f207639528e2a473ee24843e326929611918b078488

SHA512
9abdf93911de88a3c7363e739d061fae82ee7b0391ec38e0632a761ce99f4a803dea87ed5e4d049745b4cc7e39dab817255a180d67a346d51cf0a1cb10108967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25e1e4b1661674d36b4d2b48f00230b0

SHA1
38bf15c8aa92194e2aab0313b926d3de0cceba40

SHA256
db5d75fd316fc30f67c6c47eff84fb10a5b7a53c9e61dfb7aa7598df0da19a37

SHA512
0c467a7d2859cf406bbcaac8d2061951f55b08ef228cd49900f403a8ea56d1364e0fd95ba34771bfe6ed58a838d5d0c396a6c691798203e07400aa2ef7763525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f14f08147640ae0c6058e91732e3ae6

SHA1
2b7a8b18db9e12ded45b131f102affa7efd3cc07

SHA256
f688fcdea86c209fcf3039eae4110e26f1ae4f9ffac23f9a7ca59e906a6e3031

SHA512
2259debf9a997d44e3d8fbbafa895ad923746e86a2c0b4902f78c2171a5cfadcd80e3feaf9f583fbb6902320715ec1cd99be0b444c9ca1231c962aa727dbe079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37f1ccb4fb639e77d5e70b535b6d93d4

SHA1
b252699a8eba31418d82afe539c210d9d0ee3186

SHA256
6b666d3976e6813e675dc8cb4e9c834da872c85463c1b70802ff135087c01c71

SHA512
89cf524e585e9935e2813b50baa6e7d312336e85eb5bbe57029cf2fcb43cac90725f82e436365a8f89f1accbd8c1983cfce11ec8c92ee6a6b2695ee3c8d7af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31062401b0110d05afd20d3b2cb43a59

SHA1
640910c2519cf48fa1dd6e7c2aedf07da8c621d8

SHA256
65a14a2807a13c243cbc319ed39b5730db2ef8921b2e4d396f9d4b6afbc06b02

SHA512
941f0fcd37d43c7b4bf055a3e475a3a5d4eaf1bf0822a39084736373909ba24b0130c6155f04186324641cea990606537f0c1c3abe88a2d046479cf82e6fd601

Download Submit
C:\Users\Admin\AppData\Local\Temp\0uTXzTWsAa.bat

Filesize
197B

MD5
ed1a35a37d1d778ef1cc2f3bc28004f4

SHA1
208dfde075c74dc1b7bd43f3bed8578f9a12fffa

SHA256
843783784d25c1e8f61f65d171e3d433f86e88b9537f19e58028452c4a891ee1

SHA512
916e17323fb24c505f754bfca94b8b5730260d9e1f89a0659734127ad20fc91cfec793455075e1085f0eb1faf6353279336dfda4c04bdaa860d02e4048a7542f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

Filesize
197B

MD5
49818953ec2f25c377345f8d311598e4

SHA1
bdbf0633b1de94a5e7b5ef08ababf55977422b6b

SHA256
9e06c7db062dde50bcb88a8d0f657d9e9af55bcf063b896d16e292e555c7b660

SHA512
684c9e2f9a1faa66de050aca6b2817d61e954000f8061f76baaaef1eb897ad64b1173f4ca96d42d010ff81425ed4c377376c642a39ef053761f011ba8bd0fede

Download Submit
C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat

Filesize
197B

MD5
7060e8beae4cdc299d51f7a86e7e67ce

SHA1
639c5af53d4c5027821d9886df3e3da9772ecb36

SHA256
26763933059d6454be94b9fbef2f064f2770d11c8e3e2303ee94c972a667cb93

SHA512
e2632471aafad0f147cbb331810b39f8995c6343e84d8548a315d1c7fe05b60f53341f07084e14c3e8104724f11f1ca8865ff357f580683c0bb1c88c37bc37f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

Filesize
197B

MD5
ad86a9d6d456338396d80aeec28626cb

SHA1
1690b59951f892c4e3076f5f5ba8cf97d9c55380

SHA256
f80faa614d6a472aead3b99b8d185a3200389838683221709792e59778e2770e

SHA512
e3d327491d2b92c47eb4db71a69c4abfde8dd444b582fa7c83efbc7d488abd27a739813fae9ff8ed9039f24d996730d22b0bea5927a24b3829da062b594738d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat

Filesize
197B

MD5
3f3c15326e752cef7313ffc83548b3a9

SHA1
66b1f073d1d5f2674adf981be1d9399ccd3a0593

SHA256
95e5bed0e9368652cda235bbbc603506a6a2c102e96a54daac8b35b3cd8840e1

SHA512
a27fafb4396e0d5233887a38d1a1f395f834b29b561ed15084d6477271f6f9ef9024571cd558fcf2e02752b8d3f3d0ffa7acdab7446cc9d04e1e5102800d01c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC6A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC7D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UTkrWZWekQ.bat

Filesize
197B

MD5
25e42829e5b45de5189f91172dada487

SHA1
e6934dc48ec0da9aa847f31b68cd151cb621d68c

SHA256
364d584eb11c3973ef79af0fea3fe868a860e8c211c375c8cb5b374be38b637d

SHA512
1c96c3d2322f2a68a6d0be12c0bf8c12eaa27d0a5a8c5d3603c9815176bd57456eb6c8a0a36d6b1124a7106717a6eda1518cdb77374b50abf969e4185e4028c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat

Filesize
197B

MD5
88f5928fc4d00e1b3286e206cefba741

SHA1
b784ab489db084edc861c6dcd1916b39c01772f4

SHA256
7988dc97ccb9f5401f5ed720ac91048f04950e2ff4098b99477e1f5f9f187755

SHA512
aec9f05fbaa5bba89ffc864d10652dc56a51e9622c43e8e86367c80538fef5db553927575610bbc307399577ff6afcf1357510156b33576052d72ae1cdd0e8c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tcplHXgq9Q.bat

Filesize
197B

MD5
f92ef77d46781ddfb4c12bfd03458839

SHA1
32be70998cda972055237b0f40241f6f367590ef

SHA256
581177dcbc21ccde98d45937dcc6ef01905b16f63323e58185fe8b6feef971e2

SHA512
0f2082b6eb9b5735f0f88bae01e76acbc7bc6ac4aeddaa326d2f9330ff6bbb854d4d4be3b80b21536c0549e159a488fffd097cc0c4abed6a27f2c01792345958

Download Submit
C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat

Filesize
197B

MD5
af47b959c5fe6f26c38ff513597fdd87

SHA1
2dfa5d4b3a55fa1873cae8f90609d11770d34d99

SHA256
7a1eeb2b7203de070c728b1f07881f432224ce44786c4c44fc8a54ed067c4f3c

SHA512
2b210cf514ea0cf82729823a63b2aff9831de34749bdf4e10d5882d2cfd58e90e99fa7695cb70965844402c6c59d947198f4fa30a168c85a078e0ce417d587db

Download Submit
C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat

Filesize
197B

MD5
8a3925f7015d00a68355d68aa51da30a

SHA1
23b6112ecdeca4416a53b4936f0ab381996ad5bb

SHA256
7280ce6eedc6ad0de6feb6909da75c43d3197868ad346f62199dca949e04476a

SHA512
7caec0c7b0986d5884b0917d9be1e8ceb8cc4946ef85d947ab4650fec953fd405f81a03f6595ff9fb7e8280d88cfc21e40c7eed43f76683856439f2f2e820f0f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3b8d2cb8cdaf89657824d6d161684347

SHA1
08fcd5d42263fdfbd65bbf98f5a4519605c8e3c8

SHA256
ad6a6204cdf59a136c35644d36feeac60cdefbb15f9c087c90c3f1a5270f6b04

SHA512
a8d1b11eaf4341f02c58eb0d5169ae0401f888587845204bf7262f712ddc9d1bed6b5d64ec09ae8542e5b7cca9dd706f6648182c3ee69c7efbe73c1c03d139fb

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/296-719-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/296-720-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/904-159-0x0000000000210000-0x0000000000320000-memory.dmp

Filesize
1.1MB

Download
memory/1244-240-0x0000000000B50000-0x0000000000C60000-memory.dmp

Filesize
1.1MB

Download
memory/1904-599-0x0000000000C90000-0x0000000000DA0000-memory.dmp

Filesize
1.1MB

Download
memory/1936-36-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1936-37-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2300-479-0x00000000003C0000-0x00000000004D0000-memory.dmp

Filesize
1.1MB

Download
memory/2488-659-0x0000000000090000-0x00000000001A0000-memory.dmp

Filesize
1.1MB

Download
memory/2580-359-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/2580-360-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2756-17-0x0000000000200000-0x000000000020C000-memory.dmp

Filesize
48KB

Download
memory/2756-16-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/2756-15-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2756-14-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/2756-13-0x0000000001020000-0x0000000001130000-memory.dmp

Filesize
1.1MB

Download
memory/2784-171-0x0000000000850000-0x0000000000960000-memory.dmp

Filesize
1.1MB

Download
memory/2820-539-0x00000000001E0000-0x00000000002F0000-memory.dmp

Filesize
1.1MB

Download
memory/2836-780-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download