dcrat | 91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
Size

1.3MB
MD5

cdc7edfa02506d18c09374011227dd04
SHA1

2a3243f30b3cb73d7d19aa2b24085b195b59ae36
SHA256

91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009
SHA512

f84fc0637fd9ec8b1c057025207ed79984d96318509a4f27dd3bc417433e9eadc4a7ad76e86a56a0bac105e0ebc425bc67e4be1358501a824143a87834a46277
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2728	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2728	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00080000000167dc-12.dat	dcrat
behavioral1/memory/2108-13-0x0000000000DB0000-0x0000000000EC0000-memory.dmp	dcrat
behavioral1/memory/2216-105-0x0000000000870000-0x0000000000980000-memory.dmp	dcrat
behavioral1/memory/1836-257-0x0000000001390000-0x00000000014A0000-memory.dmp	dcrat
behavioral1/memory/1708-377-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/2408-437-0x00000000001E0000-0x00000000002F0000-memory.dmp	dcrat
behavioral1/memory/1352-498-0x0000000000890000-0x00000000009A0000-memory.dmp	dcrat
behavioral1/memory/3052-559-0x0000000001120000-0x0000000001230000-memory.dmp	dcrat
behavioral1/memory/772-678-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/904-738-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
1476	powershell.exe
1708	powershell.exe
2092	powershell.exe
1528	powershell.exe
2020	powershell.exe
1536	powershell.exe
1412	powershell.exe
2344	powershell.exe
1168	powershell.exe
1168	powershell.exe
340	powershell.exe
1720	powershell.exe
2944	powershell.exe
1848	powershell.exe
1716	powershell.exe
1080	powershell.exe
2692	powershell.exe
2504	powershell.exe
1808	powershell.exe
600	powershell.exe
876	powershell.exe
592	powershell.exe
2960	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2108	DllCommonsvc.exe
1776	DllCommonsvc.exe
2216	WmiPrvSE.exe
1836	WmiPrvSE.exe
2936	WmiPrvSE.exe
1708	WmiPrvSE.exe
2408	WmiPrvSE.exe
1352	WmiPrvSE.exe
3052	WmiPrvSE.exe
1224	WmiPrvSE.exe
772	WmiPrvSE.exe
904	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2956	cmd.exe
2956	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
37	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\TableTextService\it-IT\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\ja-JP\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\ja-JP\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\101b941d020240	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Media\Characters\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\ehome\fr-FR\services.exe	DllCommonsvc.exe
File created	C:\Windows\ehome\fr-FR\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\it-IT\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\it-IT\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Windows\Setup\State\audiodg.exe	DllCommonsvc.exe
File created	C:\Windows\Setup\State\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Windows\Media\Characters\lsass.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
328	schtasks.exe
1844	schtasks.exe
2060	schtasks.exe
480	schtasks.exe
3064	schtasks.exe
2364	schtasks.exe
2364	schtasks.exe
1804	schtasks.exe
3000	schtasks.exe
2920	schtasks.exe
1116	schtasks.exe
524	schtasks.exe
2840	schtasks.exe
1204	schtasks.exe
1860	schtasks.exe
820	schtasks.exe
2608	schtasks.exe
2464	schtasks.exe
1000	schtasks.exe
2948	schtasks.exe
2656	schtasks.exe
2312	schtasks.exe
2636	schtasks.exe
2252	schtasks.exe
2372	schtasks.exe
1784	schtasks.exe
2724	schtasks.exe
2972	schtasks.exe
3008	schtasks.exe
2072	schtasks.exe
1992	schtasks.exe
696	schtasks.exe
2208	schtasks.exe
2256	schtasks.exe
1172	schtasks.exe
2448	schtasks.exe
784	schtasks.exe
852	schtasks.exe
2256	schtasks.exe
2804	schtasks.exe
1780	schtasks.exe
2800	schtasks.exe
2812	schtasks.exe
2272	schtasks.exe
896	schtasks.exe
2500	schtasks.exe
1788	schtasks.exe
1400	schtasks.exe
1084	schtasks.exe
2156	schtasks.exe
772	schtasks.exe
2272	schtasks.exe
2084	schtasks.exe
3060	schtasks.exe
556	schtasks.exe
660	schtasks.exe
2972	schtasks.exe
1324	schtasks.exe
2716	schtasks.exe
2372	schtasks.exe
1140	schtasks.exe
1592	schtasks.exe
1400	schtasks.exe
2968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2108	DllCommonsvc.exe
2108	DllCommonsvc.exe
2108	DllCommonsvc.exe
1168	powershell.exe
1476	powershell.exe
600	powershell.exe
592	powershell.exe
2504	powershell.exe
1808	powershell.exe
1776	DllCommonsvc.exe
1776	DllCommonsvc.exe
1776	DllCommonsvc.exe
1776	DllCommonsvc.exe
1776	DllCommonsvc.exe
1720	powershell.exe
340	powershell.exe
2960	powershell.exe
1412	powershell.exe
1080	powershell.exe
2344	powershell.exe
1848	powershell.exe
1168	powershell.exe
2928	powershell.exe
2944	powershell.exe
1528	powershell.exe
1536	powershell.exe
2092	powershell.exe
1708	powershell.exe
1716	powershell.exe
2692	powershell.exe
2020	powershell.exe
876	powershell.exe
2216	WmiPrvSE.exe
1836	WmiPrvSE.exe
2936	WmiPrvSE.exe
1708	WmiPrvSE.exe
2408	WmiPrvSE.exe
1352	WmiPrvSE.exe
3052	WmiPrvSE.exe
1224	WmiPrvSE.exe
772	WmiPrvSE.exe
904	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	DllCommonsvc.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1776	DllCommonsvc.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	2216	WmiPrvSE.exe
Token: SeDebugPrivilege	1836	WmiPrvSE.exe
Token: SeDebugPrivilege	2936	WmiPrvSE.exe
Token: SeDebugPrivilege	1708	WmiPrvSE.exe
Token: SeDebugPrivilege	2408	WmiPrvSE.exe
Token: SeDebugPrivilege	1352	WmiPrvSE.exe
Token: SeDebugPrivilege	3052	WmiPrvSE.exe
Token: SeDebugPrivilege	1224	WmiPrvSE.exe
Token: SeDebugPrivilege	772	WmiPrvSE.exe
Token: SeDebugPrivilege	904	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2120	1992	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	30
PID 1992 wrote to memory of 2120	1992	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	30
PID 1992 wrote to memory of 2120	1992	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	30
PID 1992 wrote to memory of 2120	1992	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	30
PID 2120 wrote to memory of 2956	2120	WScript.exe	31
PID 2120 wrote to memory of 2956	2120	WScript.exe	31
PID 2120 wrote to memory of 2956	2120	WScript.exe	31
PID 2120 wrote to memory of 2956	2120	WScript.exe	31
PID 2956 wrote to memory of 2108	2956	cmd.exe	33
PID 2956 wrote to memory of 2108	2956	cmd.exe	33
PID 2956 wrote to memory of 2108	2956	cmd.exe	33
PID 2956 wrote to memory of 2108	2956	cmd.exe	33
PID 2108 wrote to memory of 592	2108	DllCommonsvc.exe	50
PID 2108 wrote to memory of 592	2108	DllCommonsvc.exe	50
PID 2108 wrote to memory of 592	2108	DllCommonsvc.exe	50
PID 2108 wrote to memory of 1476	2108	DllCommonsvc.exe	51
PID 2108 wrote to memory of 1476	2108	DllCommonsvc.exe	51
PID 2108 wrote to memory of 1476	2108	DllCommonsvc.exe	51
PID 2108 wrote to memory of 1168	2108	DllCommonsvc.exe	52
PID 2108 wrote to memory of 1168	2108	DllCommonsvc.exe	52
PID 2108 wrote to memory of 1168	2108	DllCommonsvc.exe	52
PID 2108 wrote to memory of 2504	2108	DllCommonsvc.exe	53
PID 2108 wrote to memory of 2504	2108	DllCommonsvc.exe	53
PID 2108 wrote to memory of 2504	2108	DllCommonsvc.exe	53
PID 2108 wrote to memory of 1808	2108	DllCommonsvc.exe	54
PID 2108 wrote to memory of 1808	2108	DllCommonsvc.exe	54
PID 2108 wrote to memory of 1808	2108	DllCommonsvc.exe	54
PID 2108 wrote to memory of 600	2108	DllCommonsvc.exe	55
PID 2108 wrote to memory of 600	2108	DllCommonsvc.exe	55
PID 2108 wrote to memory of 600	2108	DllCommonsvc.exe	55
PID 2108 wrote to memory of 2780	2108	DllCommonsvc.exe	62
PID 2108 wrote to memory of 2780	2108	DllCommonsvc.exe	62
PID 2108 wrote to memory of 2780	2108	DllCommonsvc.exe	62
PID 2780 wrote to memory of 1296	2780	cmd.exe	64
PID 2780 wrote to memory of 1296	2780	cmd.exe	64
PID 2780 wrote to memory of 1296	2780	cmd.exe	64
PID 2780 wrote to memory of 1776	2780	cmd.exe	65
PID 2780 wrote to memory of 1776	2780	cmd.exe	65
PID 2780 wrote to memory of 1776	2780	cmd.exe	65
PID 1776 wrote to memory of 1168	1776	DllCommonsvc.exe	117
PID 1776 wrote to memory of 1168	1776	DllCommonsvc.exe	117
PID 1776 wrote to memory of 1168	1776	DllCommonsvc.exe	117
PID 1776 wrote to memory of 340	1776	DllCommonsvc.exe	118
PID 1776 wrote to memory of 340	1776	DllCommonsvc.exe	118
PID 1776 wrote to memory of 340	1776	DllCommonsvc.exe	118
PID 1776 wrote to memory of 1720	1776	DllCommonsvc.exe	119
PID 1776 wrote to memory of 1720	1776	DllCommonsvc.exe	119
PID 1776 wrote to memory of 1720	1776	DllCommonsvc.exe	119
PID 1776 wrote to memory of 2020	1776	DllCommonsvc.exe	120
PID 1776 wrote to memory of 2020	1776	DllCommonsvc.exe	120
PID 1776 wrote to memory of 2020	1776	DllCommonsvc.exe	120
PID 1776 wrote to memory of 1708	1776	DllCommonsvc.exe	121
PID 1776 wrote to memory of 1708	1776	DllCommonsvc.exe	121
PID 1776 wrote to memory of 1708	1776	DllCommonsvc.exe	121
PID 1776 wrote to memory of 2092	1776	DllCommonsvc.exe	122
PID 1776 wrote to memory of 2092	1776	DllCommonsvc.exe	122
PID 1776 wrote to memory of 2092	1776	DllCommonsvc.exe	122
PID 1776 wrote to memory of 2960	1776	DllCommonsvc.exe	123
PID 1776 wrote to memory of 2960	1776	DllCommonsvc.exe	123
PID 1776 wrote to memory of 2960	1776	DllCommonsvc.exe	123
PID 1776 wrote to memory of 876	1776	DllCommonsvc.exe	124
PID 1776 wrote to memory of 876	1776	DllCommonsvc.exe	124
PID 1776 wrote to memory of 876	1776	DllCommonsvc.exe	124
PID 1776 wrote to memory of 1716	1776	DllCommonsvc.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\ja-JP\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:600
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5HgwEuCkaa.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2780
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1296
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Characters\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ehome\fr-FR\services.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\OSPPSVC.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\it-IT\smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat"
        8⤵
        
        PID:2184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2064
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat"
        10⤵
        
        PID:2604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1580
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"
        12⤵
        
        PID:2144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2800
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"
        14⤵
        
        PID:2340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:820
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
        16⤵
        
        PID:1628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2116
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat"
        18⤵
        
        PID:2856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1512
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o0FbW2pZd9.bat"
        20⤵
        
        PID:2112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1344
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BjebbrynYr.bat"
        22⤵
        
        PID:1196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2412
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat"
        24⤵
        
        PID:2880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2844
        
        C:\MSOCache\All Users\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\WmiPrvSE.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"
        26⤵
        
        PID:1856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Public\Documents\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Searches\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Searches\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Searches\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Setup\State\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\State\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Journal\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Characters\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Media\Characters\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Characters\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\ehome\fr-FR\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ehome\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\ehome\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\it-IT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\spoolsv.exe'" /rl HIGHEST /f
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b92653e9aeb25818717c8fe5b9feea

SHA1
f7a74af550aa013308e2d4a14016ef5c49f71e4a

SHA256
8599d02f0e8203c44834732994f6c5ee25bb63354414d81ccd7f6d74450cf17c

SHA512
9c58e76d4c64da8f02d5d8078d46fcd4bfcf33fb9f18cd5c7315da64ec38b0e9f575ac050241178edc647a31cf3373c1f5e26c0afabfc1d19109b0abb6e0852c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d69794586008976290565c23b4ebf208

SHA1
b2370f9550e5788310d079c85233f6de02e43f05

SHA256
d5f414404060951bdfdf3a12e3d0e4e40789133464f3f149912f7d762b7bf62e

SHA512
8f80a75d426db21c56a76b389f0b59165660e3ffa3d5a4d7343980631e21ffc421298a8e4882829b9a4505b0b6b3fde46261afc9883d84351892704cc4d7a6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b037ac8a2b308f339b6e3fc720c72f

SHA1
172953236d8261d42f2088fc784db3afec4191dc

SHA256
cd510d5b2a48830d26573f4c2beb99f35743fb12a9e5674fc391f6e2982738d2

SHA512
2363d267ab89b6a96e03b6bcdba87a04cadc081cdc3dca1c4dfb095de97cf17fa8677e09a8f335d68c0b35f39056df5c8909269d7db4d97bc2d24c801f7f02e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22efb2d453b09c4123bbc05060f8f1ac

SHA1
eacccd0e48038226434e14c078418a27abb8f2e4

SHA256
b246c5ac7d4a6fb5a92647a742cb49d0c370042eec2332e41b52f29d2f044759

SHA512
da956882373f9fdaef9b1916ed6413826708c1cd9c0b34ad66bd2efb6a543f1dc6ad2d0dabd89d32fc52ba2c1120f03d55b92edd132afefe387afbb36b0667dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71b8cb50b895df328373306c8821d152

SHA1
0b08c8b9be417f8dad3714ddd0b8a82413aa0fa2

SHA256
85b946fc558c82b742108f7b4de94c6b05adc02ff705de20729cce20a953e4a6

SHA512
5b6acf59ba8c01184ba64396d4b85cfddbc098475b841912edea70307df2f3597203e44cd675450c731722fed0decbbeb23af2f986c5bdf1256eab07b8d9a15a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea84f06f29bacf282e098d38aa69cab2

SHA1
5892f929b5f50591ca4a89598e4734262b49d7fd

SHA256
c61c6d033548c2dc319e48c10d7ab6a04e78f0caff7b14bbea71221faab61f93

SHA512
0e900e163f92b478bbb3ccd87d49953b14e3338c7d0c8dafe869243333ecae7188d28dcaabd115039b6bfc3c21548afa9bc796ed847e124e9e57a77ebfd3acdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f8a7c91e71902fd2d07ba0dc55dba72

SHA1
4cd5ec027ff39342d6266e5ad74ed511efd90d93

SHA256
0ce2bd09443f03afd5f079a85ca480b898fb68356f66f9178f599f712877601b

SHA512
a6294da2a08536d72bab0bea66c51cf50270c84532607525c5610c31c62392f2f2cae13d4bf5a484aefe7e966fbfa9c67ba8311cc62255e9ac1f621a80b78442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8602702ac6584a41e5d2abd154da4ab3

SHA1
c7b1715157fdf93eee1e959c483c0f4d4b42d5c9

SHA256
ebbafd1fa4b29b0b9dfba97ae7dc3aa82057395d1a51f586a31bfa1b348128e6

SHA512
2753fd95a3fa228c551542b123ea968d0d78976a9ebc966a8c6904c07937b714454777c34b973f4e05f9eecad557dbee68b49cb27bad3dff12cd36c495f8b9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0312a46270f687c6488baeae2f52849d

SHA1
7a0807d64297e4e247279766e0b1104712392a82

SHA256
ed5461887c55b2087f06c9869ad411c04ec39270454c309398076b017dfe3a67

SHA512
074ddae3ec0c493116aac15935c656cbdd5bd4536a2491c923b511b79b18e3fb97508549de7e79a049ac07490a087a586adb4a091eca4cfd88085fe13abfa13c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat

Filesize
199B

MD5
ca8e3f710c6d5d87402a46a5054b17ad

SHA1
5f5729498fc7306cc0c521a80bca27d1d0cf3645

SHA256
593ed84171d8054b0d4ba0380d271fd6c53694bd67e682aa7c60953fb75b19b5

SHA512
9b1ff2c920dadf285dbe9ffcbd9c83ec018bae8842bbcd1cb288bd7b4ced0a6bc454344ab69fd8c30a3f2893293e0231b9f04f88e2667a742a6381e08cf19711

Download Submit
C:\Users\Admin\AppData\Local\Temp\5HgwEuCkaa.bat

Filesize
199B

MD5
4832adb7fbbe398101e31b8d639eb42c

SHA1
5bbcd0c223ac3b959c46301b7b522b997114337f

SHA256
c6a976bd30c7603ec84c3d17dc14e0b19aaa9c224c73f4db6e50fc883f86d7d9

SHA512
156cf26877f4a8bac87ff71fcc458f4d7db81c42268ea93dd9f69529cf07a4c484bd30471800185a63e25c60579102ec5863820690a48499fbf65f1ea18d9bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat

Filesize
199B

MD5
01ff851e0e0c98022959411a4723e778

SHA1
c0d2dcaa1a7e4d2b79c8a6338999d8f6d12aa973

SHA256
d1234ac0093ea906e75fddc2cd77c5fece95b350abe466944c41c2d724c7e7c2

SHA512
626abe6e3c8ba818b71bc93fc69794345fe47de1cb16f0170f3f7edcd0f9ab5a9871a2e855393834ebb7d0b9e4f5a7882b5efafae8fd9cf66b92eb563dc948d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BjebbrynYr.bat

Filesize
199B

MD5
31c050f3fef931606f5b269d6bae4386

SHA1
9eeefb45ab6c37a591a15d29edcfea6c8c84eff3

SHA256
0d5c5d904f2f43af420df1ec6e7640d72273f580bf5ac7c6873904b27208d83d

SHA512
1aa2c54256fb3ae07dd05ef051d703dd7e38ff9ebaaf8fdf4445d961c739ff789c1950baa6f55acb734a08a912987c1e4d3bc58df6f2babd0ffbaef808e73033

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB4B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB6D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

Filesize
199B

MD5
7c5615940d6b3af77b3a27dbeb241016

SHA1
b09c1c86a7b465a391eac9cada9892ada141fc7f

SHA256
fa942d23aab9b2317954b1e55829d55e011f47307a23614ce18e4b6fafcde759

SHA512
ae4ed2f84ed2a4a678166fed3e300e265a89c48f934164ded4db2f2385bc7b0302803f8343ed05f5674b2794096ed724f0b806ca0be923126fecc83ba1db3fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat

Filesize
199B

MD5
dc72b1ce13a85e07f3da8f16d78e9093

SHA1
c6844889cac5e0ebc056abde301dd191362515a5

SHA256
3d19ad1c2d9cb9271b92d8d695d753045ecb183fc672b424f9521880953d995b

SHA512
36af234a27f9be7a23f6fb518fc3663bf4fe8454d27664146c6fe27c58040136a002b79c49c9b8f69132650ccabbe66ebb6c5ebcaa419be96660e9ead1bd639c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat

Filesize
199B

MD5
2c3a9461419a07751d3cfe9125725368

SHA1
907b58519718f6966d14651f4503596abee6bcde

SHA256
608dad619235f65eecb639fabf6ea45eed00016965551cc1753b7f4a4fe4ebd4

SHA512
755c0928bc9906b3947abfefb5e1b551aa913a2f11fdeebbff4f22779e8e9182b30560545b0d65c100f071f48a4103a316449a23d1553d1ea522646d84d5f6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\o0FbW2pZd9.bat

Filesize
199B

MD5
c32d648816a86949adec59d5a537605a

SHA1
d25590332e64d15cfd7d9b47ba4118d437543b46

SHA256
8afb7d48b0146dde7bf80412dbb0a2589cdd5b48bbd80afc28de074180739f78

SHA512
f1ccc16cce69791bc965dd28f920a7c511cc146efa87bbb79c8b83072235d742dfe7308fa3a7e96281b1349b55263cc54ecd0dff902c15cb161c28a0b643d0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat

Filesize
199B

MD5
693c20bda5a757cc8ce2eccdf87171c4

SHA1
a86157c52f0087f37cf69e3b016ae2e7474ab05f

SHA256
a8faf979f3ab3e2ebd69d2ada7a02b3084dcefbc3be53cde5d6267acbc22360c

SHA512
251df32dc1dbedc09aca7f876269913b5569385721bb1f7b21951869bc7fa73713a5792772124020ffd5cdd29621f9ed6645f5eca2610c28347ac094e52963bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat

Filesize
199B

MD5
43a28d3450af4b6daa93cf72ee0615a0

SHA1
170263dff7b7fff150735f8afd56eb8e316b0902

SHA256
6bd36b23283dca434a6d82ac0e4994f855a926c13e95e8a90e27d73980b0fa21

SHA512
f27c148625e22c2a32593f57f32bfbe0f33c504c257276b9fb98342ad05f9de67555de3f284c81974d3f7613f550511b7476b8e84aef2de9974f94dd74dd83e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

Filesize
199B

MD5
ced00031cbc4c87bf4245fef82ef572b

SHA1
15598a459b6ee0d3c099f7df98df122c2e9c5cd6

SHA256
346edbfeb01f881e697034ccc20dcef8fa9632516af2d5ad3a32a63d301539db

SHA512
8bf2d773776ddf8290414385a1ae7e955deb295c0291c6888c59e65d46e643b5fd88275710062a60068a4b49281676f7164934d590d3ff0f2a5fbd583cb79c34

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c87132a570f2584e9dd381a39134b36e

SHA1
c0d6897714ebd1bcc986f42181911f4a89f0bd61

SHA256
57ffcb3cb6e0de579694d983681cebf784a0969aad8d6ab0a9f1a77196d4d603

SHA512
c9ecf992a3d666b239a0766fcfd2752e9f8e474b6a08ba3d681931b2b0ad01f7c1ea0b8f4ee0493283aaf0e764eab6763ab9bef07a4de23f2694c83955221238

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/772-678-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/904-738-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/904-739-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1168-51-0x0000000002630000-0x0000000002638000-memory.dmp

Filesize
32KB

Download
memory/1352-498-0x0000000000890000-0x00000000009A0000-memory.dmp

Filesize
1.1MB

Download
memory/1352-499-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1476-46-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1708-377-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/1720-114-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/1720-111-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/1836-257-0x0000000001390000-0x00000000014A0000-memory.dmp

Filesize
1.1MB

Download
memory/1836-258-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2108-13-0x0000000000DB0000-0x0000000000EC0000-memory.dmp

Filesize
1.1MB

Download
memory/2108-14-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2108-15-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/2108-16-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2108-17-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2216-105-0x0000000000870000-0x0000000000980000-memory.dmp

Filesize
1.1MB

Download
memory/2408-438-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2408-437-0x00000000001E0000-0x00000000002F0000-memory.dmp

Filesize
1.1MB

Download
memory/3052-559-0x0000000001120000-0x0000000001230000-memory.dmp

Filesize
1.1MB

Download