dcrat | bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380

Analysis

max time kernel
148s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/12/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe
Size

1.3MB
MD5

8e739aead9321f4a00bad1c95135a165
SHA1

7ca5676bafc079bcf1418187e0e30a60a1470073
SHA256

bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380
SHA512

81d3e230dac966ccee5a7161bf6ea0559cc0ec2203af004efe7ab56b2b498067d9817a3063fb5136426a1a24e55a45038793b2db2d437311c26f05f1eb7a287a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2592	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2592	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001706d-12.dat	dcrat
behavioral1/memory/2596-13-0x00000000009A0000-0x0000000000AB0000-memory.dmp	dcrat
behavioral1/memory/2112-129-0x00000000001B0000-0x00000000002C0000-memory.dmp	dcrat
behavioral1/memory/2712-215-0x00000000011B0000-0x00000000012C0000-memory.dmp	dcrat
behavioral1/memory/2712-452-0x0000000001330000-0x0000000001440000-memory.dmp	dcrat
behavioral1/memory/2784-630-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat
behavioral1/memory/3040-690-0x00000000011A0000-0x00000000012B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe
1780	powershell.exe
2492	powershell.exe
1964	powershell.exe
568	powershell.exe
1044	powershell.exe
480	powershell.exe
2992	powershell.exe
2076	powershell.exe
2984	powershell.exe
2040	powershell.exe
592	powershell.exe
776	powershell.exe
1032	powershell.exe
1276	powershell.exe
1088	powershell.exe
1480	powershell.exe
584	powershell.exe
1516	powershell.exe
1032	powershell.exe
2600	powershell.exe
1624	powershell.exe
1468	powershell.exe
1340	powershell.exe
1636	powershell.exe
1672	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2596	DllCommonsvc.exe
992	DllCommonsvc.exe
2112	DllCommonsvc.exe
2712	dllhost.exe
2828	dllhost.exe
1448	dllhost.exe
444	dllhost.exe
2712	dllhost.exe
2828	dllhost.exe
1616	dllhost.exe
2784	dllhost.exe
3040	dllhost.exe
2008	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2680	cmd.exe
2680	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com
29	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
20	raw.githubusercontent.com
5	raw.githubusercontent.com
16	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\lib\deploy\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\it-IT\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\en-US\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\en-US\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\lib\deploy\088424020bedd6	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\it-IT\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe	DllCommonsvc.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\Branding\ShellBrd\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\ja-JP\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\Resources\Themes\Aero\it-IT\System.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\de-DE\lsass.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\de-DE\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Windows\Branding\ShellBrd\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Resources\Themes\Aero\it-IT\27d1bcfc3c54e0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1992	schtasks.exe
1632	schtasks.exe
2260	schtasks.exe
2864	schtasks.exe
2764	schtasks.exe
2144	schtasks.exe
2728	schtasks.exe
2228	schtasks.exe
1804	schtasks.exe
900	schtasks.exe
2484	schtasks.exe
2724	schtasks.exe
920	schtasks.exe
2992	schtasks.exe
3040	schtasks.exe
2256	schtasks.exe
1996	schtasks.exe
2548	schtasks.exe
964	schtasks.exe
1572	schtasks.exe
2944	schtasks.exe
892	schtasks.exe
1744	schtasks.exe
2656	schtasks.exe
2964	schtasks.exe
2832	schtasks.exe
2140	schtasks.exe
776	schtasks.exe
2052	schtasks.exe
2060	schtasks.exe
1484	schtasks.exe
2208	schtasks.exe
1784	schtasks.exe
296	schtasks.exe
2432	schtasks.exe
792	schtasks.exe
2568	schtasks.exe
1648	schtasks.exe
3064	schtasks.exe
1976	schtasks.exe
572	schtasks.exe
704	schtasks.exe
108	schtasks.exe
3004	schtasks.exe
2156	schtasks.exe
1516	schtasks.exe
464	schtasks.exe
2788	schtasks.exe
2760	schtasks.exe
2184	schtasks.exe
2656	schtasks.exe
1276	schtasks.exe
2012	schtasks.exe
2652	schtasks.exe
2820	schtasks.exe
1736	schtasks.exe
2160	schtasks.exe
2952	schtasks.exe
1632	schtasks.exe
892	schtasks.exe
2616	schtasks.exe
2000	schtasks.exe
2524	schtasks.exe
1720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2596	DllCommonsvc.exe
2596	DllCommonsvc.exe
2596	DllCommonsvc.exe
592	powershell.exe
1032	powershell.exe
1480	powershell.exe
2040	powershell.exe
1516	powershell.exe
568	powershell.exe
584	powershell.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
992	DllCommonsvc.exe
2076	powershell.exe
3056	powershell.exe
480	powershell.exe
776	powershell.exe
1624	powershell.exe
2600	powershell.exe
1044	powershell.exe
2992	powershell.exe
2112	DllCommonsvc.exe
1964	powershell.exe
2492	powershell.exe
1780	powershell.exe
1340	powershell.exe
1276	powershell.exe
1032	powershell.exe
1088	powershell.exe
1636	powershell.exe
2984	powershell.exe
1468	powershell.exe
1672	powershell.exe
2712	dllhost.exe
2828	dllhost.exe
1448	dllhost.exe
444	dllhost.exe
2712	dllhost.exe
2828	dllhost.exe
1616	dllhost.exe
2784	dllhost.exe
3040	dllhost.exe
2008	dllhost.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	DllCommonsvc.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	992	DllCommonsvc.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2112	DllCommonsvc.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2712	dllhost.exe
Token: SeDebugPrivilege	2828	dllhost.exe
Token: SeDebugPrivilege	1448	dllhost.exe
Token: SeDebugPrivilege	444	dllhost.exe
Token: SeDebugPrivilege	2712	dllhost.exe
Token: SeDebugPrivilege	2828	dllhost.exe
Token: SeDebugPrivilege	1616	dllhost.exe
Token: SeDebugPrivilege	2784	dllhost.exe
Token: SeDebugPrivilege	3040	dllhost.exe
Token: SeDebugPrivilege	2008	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2760	2652	JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe	30
PID 2652 wrote to memory of 2760	2652	JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe	30
PID 2652 wrote to memory of 2760	2652	JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe	30
PID 2652 wrote to memory of 2760	2652	JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe	30
PID 2760 wrote to memory of 2680	2760	WScript.exe	31
PID 2760 wrote to memory of 2680	2760	WScript.exe	31
PID 2760 wrote to memory of 2680	2760	WScript.exe	31
PID 2760 wrote to memory of 2680	2760	WScript.exe	31
PID 2680 wrote to memory of 2596	2680	cmd.exe	33
PID 2680 wrote to memory of 2596	2680	cmd.exe	33
PID 2680 wrote to memory of 2596	2680	cmd.exe	33
PID 2680 wrote to memory of 2596	2680	cmd.exe	33
PID 2596 wrote to memory of 1480	2596	DllCommonsvc.exe	53
PID 2596 wrote to memory of 1480	2596	DllCommonsvc.exe	53
PID 2596 wrote to memory of 1480	2596	DllCommonsvc.exe	53
PID 2596 wrote to memory of 2040	2596	DllCommonsvc.exe	54
PID 2596 wrote to memory of 2040	2596	DllCommonsvc.exe	54
PID 2596 wrote to memory of 2040	2596	DllCommonsvc.exe	54
PID 2596 wrote to memory of 568	2596	DllCommonsvc.exe	55
PID 2596 wrote to memory of 568	2596	DllCommonsvc.exe	55
PID 2596 wrote to memory of 568	2596	DllCommonsvc.exe	55
PID 2596 wrote to memory of 584	2596	DllCommonsvc.exe	56
PID 2596 wrote to memory of 584	2596	DllCommonsvc.exe	56
PID 2596 wrote to memory of 584	2596	DllCommonsvc.exe	56
PID 2596 wrote to memory of 592	2596	DllCommonsvc.exe	57
PID 2596 wrote to memory of 592	2596	DllCommonsvc.exe	57
PID 2596 wrote to memory of 592	2596	DllCommonsvc.exe	57
PID 2596 wrote to memory of 1516	2596	DllCommonsvc.exe	58
PID 2596 wrote to memory of 1516	2596	DllCommonsvc.exe	58
PID 2596 wrote to memory of 1516	2596	DllCommonsvc.exe	58
PID 2596 wrote to memory of 1032	2596	DllCommonsvc.exe	59
PID 2596 wrote to memory of 1032	2596	DllCommonsvc.exe	59
PID 2596 wrote to memory of 1032	2596	DllCommonsvc.exe	59
PID 2596 wrote to memory of 992	2596	DllCommonsvc.exe	64
PID 2596 wrote to memory of 992	2596	DllCommonsvc.exe	64
PID 2596 wrote to memory of 992	2596	DllCommonsvc.exe	64
PID 992 wrote to memory of 776	992	DllCommonsvc.exe	89
PID 992 wrote to memory of 776	992	DllCommonsvc.exe	89
PID 992 wrote to memory of 776	992	DllCommonsvc.exe	89
PID 992 wrote to memory of 1044	992	DllCommonsvc.exe	90
PID 992 wrote to memory of 1044	992	DllCommonsvc.exe	90
PID 992 wrote to memory of 1044	992	DllCommonsvc.exe	90
PID 992 wrote to memory of 480	992	DllCommonsvc.exe	91
PID 992 wrote to memory of 480	992	DllCommonsvc.exe	91
PID 992 wrote to memory of 480	992	DllCommonsvc.exe	91
PID 992 wrote to memory of 2600	992	DllCommonsvc.exe	92
PID 992 wrote to memory of 2600	992	DllCommonsvc.exe	92
PID 992 wrote to memory of 2600	992	DllCommonsvc.exe	92
PID 992 wrote to memory of 3056	992	DllCommonsvc.exe	93
PID 992 wrote to memory of 3056	992	DllCommonsvc.exe	93
PID 992 wrote to memory of 3056	992	DllCommonsvc.exe	93
PID 992 wrote to memory of 2992	992	DllCommonsvc.exe	94
PID 992 wrote to memory of 2992	992	DllCommonsvc.exe	94
PID 992 wrote to memory of 2992	992	DllCommonsvc.exe	94
PID 992 wrote to memory of 2076	992	DllCommonsvc.exe	95
PID 992 wrote to memory of 2076	992	DllCommonsvc.exe	95
PID 992 wrote to memory of 2076	992	DllCommonsvc.exe	95
PID 992 wrote to memory of 1624	992	DllCommonsvc.exe	96
PID 992 wrote to memory of 1624	992	DllCommonsvc.exe	96
PID 992 wrote to memory of 1624	992	DllCommonsvc.exe	96
PID 992 wrote to memory of 2920	992	DllCommonsvc.exe	104
PID 992 wrote to memory of 2920	992	DllCommonsvc.exe	104
PID 992 wrote to memory of 2920	992	DllCommonsvc.exe	104
PID 2920 wrote to memory of 1028	2920	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bdbde4bcae75de232adb2ea8da7c0414915e7c27909717afcfed81c3a50fe380.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\es-ES\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\ShellBrd\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:776
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\Document Themes 14\cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:480
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\schtasks.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\lib\deploy\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\lsm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\it-IT\lsm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\keDffWSCUh.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1028
        
        C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\taskhost.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\lsm.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\Aero\it-IT\System.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\en-US\DllCommonsvc.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\lsm.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\DllCommonsvc.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\smss.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\OSPPSVC.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3CX563UFPi.bat"
        8⤵
        
        PID:2808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1776
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aoAocY3YSO.bat"
        10⤵
        
        PID:920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2172
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat"
        12⤵
        
        PID:2560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2840
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat"
        14⤵
        
        PID:3036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2620
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LabqbH8bfv.bat"
        16⤵
        
        PID:2760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:620
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
        18⤵
        
        PID:2380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2700
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat"
        20⤵
        
        PID:1568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2020
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat"
        22⤵
        
        PID:2140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:464
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8zQYTmmGlF.bat"
        24⤵
        
        PID:1680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1744
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jef2EZNQSo.bat"
        26⤵
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1312
        
        C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe
        
        "C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Branding\ShellBrd\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Branding\ShellBrd\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Branding\ShellBrd\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Office\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Users\Public\Music\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre7\lib\deploy\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\deploy\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre7\lib\deploy\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\it-IT\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\ja-JP\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\Aero\it-IT\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\Aero\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\Aero\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\en-US\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\en-US\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\en-US\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Application Data\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Application Data\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Fonts\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Fonts\smss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\smss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\OSPPSVC.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Public\Downloads\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
344d821d44fd2b5776bdfee36aaaedc9

SHA1
f76f0220bcbea259335f6784d069d3d70724fc62

SHA256
433774e58ca543753af7216fd2778a2f157ebc98397d079c68a1cc587f0f8f8c

SHA512
1ea28a0e6a9918406c416132f00b400a7882f04cb009077f0f5f4539f2e37cda74a6c7215c21b57f966c14be90c61e00b0848640b1461bcda607db47067840f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c11bf7465fa7ddcef10c1aaa498c2de

SHA1
d98e26337d7e0688cd02e983ac3b87d8484f2117

SHA256
5bc43ef7735de2e389ffaf04752b92358a39c354fd4505e6f0323827222b7954

SHA512
d548e511f61d93646f5285a8dbe8f619c15268c587975e57cddd10240a9f884f6f9528d00647b3a2f2a5abfd09efdb7e15c82e06a38998121f8560ca80af9e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd284d5622c1fdbf5d2499cc0d4fa29b

SHA1
dd5bbb10a5759c46842ac70f204046edbff24d73

SHA256
f04f7371c074cb5d63fba418975e1dd8cbbadcd7333a56177342e3fa791452ec

SHA512
68e5d3943601a89faa88d12013fc3c503235322952cf840538675bdb25764d15cb3835e71b3691f0757f315cd54fb0ab76111858e8f6bd9b404fb327e4138842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad9c8ac3c57e4a3910d20622df1b3317

SHA1
63fc657c8c6d0fe1acc14d808dea1d25b73d5535

SHA256
93618558b4b541731826429f4837dfcb0a62f5e22c457b6ace040dc01ab7cd17

SHA512
3c498c05057baab234864907d8d3888093dc58ee055c7592a2280e18d68e741dbbfa947dac34b57022e20e4d1e67610731fad0071ecf2e9be2230d17874a4307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a210fd7159623bd738da9b823c956258

SHA1
3d6a4b98909e90f597ca25ef8f51b99783bc9dfa

SHA256
1532683964fa7735c119fb322c5434c1220463c619920e0691de506e2c651fe7

SHA512
cb8a287296a0c4822052d86d59fe46a8d0950174e5d2b7f711367a612a78974b7da4ebad1e676e746cf731e2657bf9e6ada34ebc92f2eeba9a2eb890e160d995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21ce626e8e4fcbcdb34590d40ff03154

SHA1
afee5b7cce0b6aa06a0765f2a33a947f4bac9fda

SHA256
904ccb746a1e19bf2f9605b8c8ed797529eac2c6bcdb27af1fe8ca1e122e1b34

SHA512
c8e2052ddff6c1b217bc4309237049ac5d37743389888f2e6727e2e89b96af148ab999cff82199492390254231d9b5a0eb364245a00c52f90378846d041df4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
329266565e22049c90589237c1c3705a

SHA1
477ccaf3d489b2404ded463ef11f45aaaea8ee8d

SHA256
1c8737ecda2db2018566e4652592c54392982c9ab9564b015dc398ed59e0e7cb

SHA512
01c04e4f66c644e4ec85ded980e2147768db9dbfdc1d95a4af8c1f173116ed875c1c77c3f592e3480563e1f9f04ff9a5870cf10e8c65b2892a088cd57668f142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
336bc3bff357baf7c4e774d935693be3

SHA1
11448fa6c3034bafeb53980362608e5fb28c3fbc

SHA256
39d1398e73398a74d69409c938237d07638b3c719b9befc475f2b78b71422acc

SHA512
079005d01d00dc1b0e71c9ae3e97fd99b29d2bc55b43084a56c55fe0a430c1f369ec13b180a143255fea0823e74b09a27fbb649c1e678bf2ff0519ee7b44647d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3CX563UFPi.bat

Filesize
218B

MD5
6b43fc334ad9cdc6cc27b285554fa129

SHA1
863ec29bfc6561f13474640182f91f3b99c92713

SHA256
03b374d8f2295d629b6b8e6fdeffa1d673e7428a3c96787bcd1b2f0512fe6ea4

SHA512
1aaaea09ebd10cadebcaf5b2d7e2a9c3429ef386eb1e592f8d73020270ded1a35dbec987301cd7d35b2bd7ddade33cba0abda6aa1f0c6e4cebc4c6da5c97acf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8zQYTmmGlF.bat

Filesize
218B

MD5
aacd106dc840ec37e0a445dec6bbb13a

SHA1
55e8057e34ef43f604319dfe66255afb0caddd43

SHA256
f3042475cf08e20972f336eecab8d4ede0054a554d5f12ecd5f94a4b44034a72

SHA512
0520cf336bf384886c1326fc89c2d1b555670f551e9bed934ff748f1ffbae6268e8c1351f91444dd0c935037bbc62dbe6059ffcc099b3b507c59649e7fee9a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A57.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jef2EZNQSo.bat

Filesize
218B

MD5
07d4a45fe9016e19c044d463e1088d14

SHA1
eaeabd3bf275e6945e51c5d3adebb582f039ff1b

SHA256
d6c407310dea1fb09de518d3b58f8fe2e8f7095d8e1699c86a3256769b208c33

SHA512
c056bc50e6c2dcff71a7b9da17457c4f71e1a93861b35730a5677575d34706c96a3919fb5559f66449de3db3a8482cd974ea1432e46856a4fab46228c9d88df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\L59TFxmxil.bat

Filesize
218B

MD5
765e6c9f153afa53ba8d92885dcddc3d

SHA1
aad4f6007b51b0831d5355ad990f43e99fa78e8b

SHA256
1b7d26f1720cf0cf4dcfb17e97cf9b294f56182a85bf6bfd1aea4de2ed4e0c58

SHA512
c3ba6ace7c7f2d0519896fcfa91c5d888ebcaeaf08e1a287803f6e24297c940722ac185b1a74e63fc66ecce434a4f498c7b5056888c552f3b37bd9457ba0a49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LabqbH8bfv.bat

Filesize
218B

MD5
b687f65b25328b29e2a8197dbc96c1b3

SHA1
9d52e1b6a60cea635a9e230200d98f0c93e76eec

SHA256
9bf52538ab716f909155427a0b1c78281965bdd0c57804ce0aad017ca9ddd811

SHA512
7bfa4c0187459e67492ae20ff9b645cf46f39a2fe60a34c519e1c245e68a30495171d1faae4677bdb79e74b30a38b9277df56eb1444160d1119937ce306d889e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A6A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\aoAocY3YSO.bat

Filesize
218B

MD5
01e65c99650317751cf806ffd1b6b9b9

SHA1
ba01d5266aa786fdb64b8c5a00245ddf72ef8f49

SHA256
96b53860c7f50d1d8234ed9f82b63bddd14a182ce725fd93e479b30cde6566f2

SHA512
24a6aa4adf95396ff11ad971694a3069cc40a0db3925e4ce1c8234be1c2c588d326276f12efa19ad7701f240c2ac7ef0b3b8a2b8742231d63b2c852f95331577

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat

Filesize
218B

MD5
f32296bba3fef9a121f774ac66a1e562

SHA1
396996d684faa11837bfe93004e357357d8b0526

SHA256
ab23c10357e6df6c9190801f55735d1bc7d5e67c505b26c45a2411f3120dfc1e

SHA512
7bdae3dd3ae5faa8a5091e654a72c590432caa7c693971d49e701187aa7caf57036e179bf3301fc54a22099e8d5f6c7e93678969f2d72e484db37e48950ef23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat

Filesize
218B

MD5
563da6c09f6fa7bdbde483c1f0a6945f

SHA1
656967e809ad01ceb887a51bb23d1f3e7ea2053e

SHA256
739427bfba049c3e8515a10fd43aab083241dc9c5e125585e13e0f264b6cf5bc

SHA512
c5b1cf5a5970fe36616d379d5f05b4e6bc1bb6778513584fe60902f31cf53dc70fc6b5b423664349cfd5aa3bc3a701355a8a75e603432f64492740a36b619055

Download Submit
C:\Users\Admin\AppData\Local\Temp\keDffWSCUh.bat

Filesize
199B

MD5
3fb018444459cc872fcb665000457f01

SHA1
a95b9503ccc59bdebe15a5b3f822348545bbfa08

SHA256
82c3cad4714797f8b9492c68e2f2de57a3dfbb6415611d7a080dff08a26342b5

SHA512
a21a934a433b4033313176a7f9dd8606087787202098ed8f6deddb951af93a9cf9c58adca9c510e9b11433e9abffa6ce2d690defec5c31c1bff571ae4672d268

Download Submit
C:\Users\Admin\AppData\Local\Temp\wRcBAgH7Mb.bat

Filesize
218B

MD5
9e47917321bc9fdad1ce7a5f6714a133

SHA1
f27cac6920f15f212501b98ccb7a475ecf8e234d

SHA256
10f00308dc058231e472456eb8efab4c25c6c25d8db1f39e189240e3a1d550d0

SHA512
73f94548d8661b56d43597f2d31c3f6340d2cadd1b53229dc42bad4c22753823383d07f9b7c429a9a5f4e197090e7e247f0820eee9bdff395da9083d1a4ccb31

Download Submit
C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat

Filesize
218B

MD5
1075338cf7dfb3fe43e92096c1109225

SHA1
bce1ce652c5cc76b1bbf29845c35d3b8b6c58471

SHA256
4ce64db6177ec8f3429cd0ce84edfa11e8757ab9b401f8b08afe3e6fe238bdb3

SHA512
0996b499e2b68db1823abd3c0a968a0872500c0da895eab2c6882573fce1c04216fbd4b79e1ce900d235c0b92987c4ed554fd2e20c8401aa06cb79f28a259ef4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
18ef14b2661abff8fd524f3f71f96713

SHA1
226ab4562a876bcb57280972ed814f4bc6c07fe1

SHA256
e64c4809275ca4f4356ddd162eec45abb69dacd5226e74aa8fce3759f49a565c

SHA512
9466214afcf01adfd3ef3cb45c400f39e679b20b2f8e57de544cba8da8c8aefec155a25ca2c683b3ef1ba993e4626cdd5338da7a543df26254ba4aade588b4fc

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/592-57-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/592-55-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/1448-333-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1964-159-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1964-167-0x0000000001CD0000-0x0000000001CD8000-memory.dmp

Filesize
32KB

Download
memory/2076-92-0x0000000001C70000-0x0000000001C78000-memory.dmp

Filesize
32KB

Download
memory/2076-90-0x000000001B820000-0x000000001BB02000-memory.dmp

Filesize
2.9MB

Download
memory/2112-129-0x00000000001B0000-0x00000000002C0000-memory.dmp

Filesize
1.1MB

Download
memory/2596-17-0x0000000002090000-0x000000000209C000-memory.dmp

Filesize
48KB

Download
memory/2596-16-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2596-15-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2596-14-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2596-13-0x00000000009A0000-0x0000000000AB0000-memory.dmp

Filesize
1.1MB

Download
memory/2712-215-0x00000000011B0000-0x00000000012C0000-memory.dmp

Filesize
1.1MB

Download
memory/2712-452-0x0000000001330000-0x0000000001440000-memory.dmp

Filesize
1.1MB

Download
memory/2784-630-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download
memory/3040-690-0x00000000011A0000-0x00000000012B0000-memory.dmp

Filesize
1.1MB

Download