Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 22:50

General

  • Target

    JaffaCakes118_17d41a40640026423bc9fe64287e6d21a802ad09b4ae7e4291cb99fbdfc1b1a2.exe

  • Size

    1.3MB

  • MD5

    865ea75d11010df558eab5ef840c565d

  • SHA1

    3c077dafd0dd1c2722ce9f73f61ed82014b47660

  • SHA256

    17d41a40640026423bc9fe64287e6d21a802ad09b4ae7e4291cb99fbdfc1b1a2

  • SHA512

    2def6aa8ccfbf181e50aeebd2c54c9dcf94c42d753ea2ef2ddc055b83f93b926f2ebd6d38a9c7ec8245047ec64c60f306ff4d84fc0296e00d58a71a82e6ba2ef

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 51 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_17d41a40640026423bc9fe64287e6d21a802ad09b4ae7e4291cb99fbdfc1b1a2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_17d41a40640026423bc9fe64287e6d21a802ad09b4ae7e4291cb99fbdfc1b1a2.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3532
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\it-IT\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3356
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4408
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3656
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\it-IT\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:536
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4836
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5088
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1128
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:772
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3500
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2028
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1592
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4176
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vm1YR7N0Qf.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4404
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:5336
              • C:\Windows\Performance\WinSAT\csrss.exe
                "C:\Windows\Performance\WinSAT\csrss.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5920
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6104
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2908
                    • C:\Windows\Performance\WinSAT\csrss.exe
                      "C:\Windows\Performance\WinSAT\csrss.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1588
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2576
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:1728
                          • C:\Windows\Performance\WinSAT\csrss.exe
                            "C:\Windows\Performance\WinSAT\csrss.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:5060
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"
                              11⤵
                                PID:440
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  12⤵
                                    PID:5556
                                  • C:\Windows\Performance\WinSAT\csrss.exe
                                    "C:\Windows\Performance\WinSAT\csrss.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:884
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"
                                      13⤵
                                        PID:3964
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          14⤵
                                            PID:372
                                          • C:\Windows\Performance\WinSAT\csrss.exe
                                            "C:\Windows\Performance\WinSAT\csrss.exe"
                                            14⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2232
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat"
                                              15⤵
                                                PID:944
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  16⤵
                                                    PID:4764
                                                  • C:\Windows\Performance\WinSAT\csrss.exe
                                                    "C:\Windows\Performance\WinSAT\csrss.exe"
                                                    16⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1496
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RaUzDWAd8R.bat"
                                                      17⤵
                                                        PID:5392
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          18⤵
                                                            PID:4540
                                                          • C:\Windows\Performance\WinSAT\csrss.exe
                                                            "C:\Windows\Performance\WinSAT\csrss.exe"
                                                            18⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3532
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
                                                              19⤵
                                                                PID:2092
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  20⤵
                                                                    PID:5784
                                                                  • C:\Windows\Performance\WinSAT\csrss.exe
                                                                    "C:\Windows\Performance\WinSAT\csrss.exe"
                                                                    20⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5904
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat"
                                                                      21⤵
                                                                        PID:5972
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          22⤵
                                                                            PID:6044
                                                                          • C:\Windows\Performance\WinSAT\csrss.exe
                                                                            "C:\Windows\Performance\WinSAT\csrss.exe"
                                                                            22⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6096
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"
                                                                              23⤵
                                                                                PID:4940
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  24⤵
                                                                                    PID:5152
                                                                                  • C:\Windows\Performance\WinSAT\csrss.exe
                                                                                    "C:\Windows\Performance\WinSAT\csrss.exe"
                                                                                    24⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2400
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"
                                                                                      25⤵
                                                                                        PID:3680
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          26⤵
                                                                                            PID:4408
                                                                                          • C:\Windows\Performance\WinSAT\csrss.exe
                                                                                            "C:\Windows\Performance\WinSAT\csrss.exe"
                                                                                            26⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4908
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat"
                                                                                              27⤵
                                                                                                PID:1736
                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                  28⤵
                                                                                                    PID:640
                                                                                                  • C:\Windows\Performance\WinSAT\csrss.exe
                                                                                                    "C:\Windows\Performance\WinSAT\csrss.exe"
                                                                                                    28⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3192
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat"
                                                                                                      29⤵
                                                                                                        PID:4016
                                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                          30⤵
                                                                                                            PID:5424
                                                                                                          • C:\Windows\Performance\WinSAT\csrss.exe
                                                                                                            "C:\Windows\Performance\WinSAT\csrss.exe"
                                                                                                            30⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3816
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DegeIw2hse.bat"
                                                                                                              31⤵
                                                                                                                PID:4460
                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                  32⤵
                                                                                                                    PID:1740
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3860
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1744
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\conhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2980
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\it-IT\TextInputHost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5040
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4296
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\it-IT\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2604
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2744
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4128
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1788
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2912
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1848
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:840
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2956
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4088
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3588
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3520
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4524
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3828
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1092
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4004
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3212
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\it-IT\winlogon.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2504
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:728
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\it-IT\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2840
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1168
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3180
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5044
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RuntimeBroker.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2444
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3988
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:956
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\providercommon\Registry.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3816
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2964
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:884
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Performance\WinSAT\csrss.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4504
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4568
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3312
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\WmiPrvSE.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4340
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Videos\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2512
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4876
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2072
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4804
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2560
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2632
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4732
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1660
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\spoolsv.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4276
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4284
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2068
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\unsecapp.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1740
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\unsecapp.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3568
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\unsecapp.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1296

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      baf55b95da4a601229647f25dad12878

                                                      SHA1

                                                      abc16954ebfd213733c4493fc1910164d825cac8

                                                      SHA256

                                                      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                      SHA512

                                                      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                      SHA1

                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                      SHA256

                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                      SHA512

                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      cadef9abd087803c630df65264a6c81c

                                                      SHA1

                                                      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                      SHA256

                                                      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                      SHA512

                                                      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      2e907f77659a6601fcc408274894da2e

                                                      SHA1

                                                      9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                      SHA256

                                                      385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                      SHA512

                                                      34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      a8e8360d573a4ff072dcc6f09d992c88

                                                      SHA1

                                                      3446774433ceaf0b400073914facab11b98b6807

                                                      SHA256

                                                      bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                                                      SHA512

                                                      4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      5f0ddc7f3691c81ee14d17b419ba220d

                                                      SHA1

                                                      f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                      SHA256

                                                      a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                      SHA512

                                                      2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      3a6bad9528f8e23fb5c77fbd81fa28e8

                                                      SHA1

                                                      f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                      SHA256

                                                      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                      SHA512

                                                      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      e8ce785f8ccc6d202d56fefc59764945

                                                      SHA1

                                                      ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                                      SHA256

                                                      d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                                      SHA512

                                                      66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                                    • C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      7ac604106a5be7c83a145256d7643d4b

                                                      SHA1

                                                      c9d20d6604d6ef10ac4ec55c988c283f9a3e0d2a

                                                      SHA256

                                                      6b750799ccd17bb88d0e1255a70b6b9e80577a941f97ab1a331ba7c7f599423f

                                                      SHA512

                                                      726f963743190bf572b3b1090c54426743fa0a32cb65278a437637272f3da5c7650522969e06c1a171b2e7875c466b339d0c986f59d275de11c31d1473f2e993

                                                    • C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      7b884e49c7549fd4880bd41f5522ee4a

                                                      SHA1

                                                      40696b6a02bef2d91772263ce6e55a781003f541

                                                      SHA256

                                                      fe484b65a0c6e909eb494d3bdf68685e074328c981e57037296f924248cac75d

                                                      SHA512

                                                      68735d0ff89699cae222522f505c4725383429c79867c3f7df1ebd050bcb59a37e36af21f84f62e5eb453fe4b606f50e66bc025a9e7afa631956448cc1fc4cc5

                                                    • C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      b80be1fe38cc52b3caef62df620f45da

                                                      SHA1

                                                      c0b7dfbe76c7f5bab2ecb54241fbd4ead2a8a076

                                                      SHA256

                                                      684b304ccdb873f080888ec31f85913e7711a8ce1189705a62894247d93b79db

                                                      SHA512

                                                      75c39b5d0869c6ad3f46c969ba0cd3b3b5aea1898e88056de3c12e1e4b48b1ee4c32f7dc304bb950ee73fd6775c44d01aa1184ce2f0c67c934559f35ffd43a01

                                                    • C:\Users\Admin\AppData\Local\Temp\DegeIw2hse.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      5ab7960398459ee5989eca07b28a7ffb

                                                      SHA1

                                                      b0808c4123f3410207c744d292c9c9ecee784412

                                                      SHA256

                                                      a1a50a21d63aec5bf615ef4ebf0fd51565ae194039f53809b5d82d75c98985d6

                                                      SHA512

                                                      06616af5143f07b35ed3972ba615dee240e4c68cab05f7c2402d63c685795a15ff7b5b1bc7f2b87320f2d4fa20ef8e5cec2909ed5f3983de1059efb9568032c2

                                                    • C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      f743578071f4735de0efabe6fb9494ea

                                                      SHA1

                                                      c15d432067a05caf7bd7f3e419b94a21ef123c11

                                                      SHA256

                                                      3d26c21273b1ea2c0cf17b8b8ec1ae8264254f0abe4cf7486b8952b4e7f9d3dd

                                                      SHA512

                                                      9bb6b49addbf5ae6c009b41371100f797642b6d5818da8c228ddb93f13ddc2075d1fc8d53673d4fb6aefe9f0431d6a7ad74c198bde58fe6760df562ecbe05e83

                                                    • C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      77eb3b7a636098aa7813f567dcf6d336

                                                      SHA1

                                                      0440247e4b25ad95157ef2d50426c439209cdd84

                                                      SHA256

                                                      8ec61c607acf48186b3bf6f4db7785a30000e63636fce2740cad689998326e76

                                                      SHA512

                                                      e443c5dd1196888692c59c9ff1c40376eff2d4cb11648cdcaa0789c4406598442300e28b8d188e06ad7e0f90bd4acdc68036c04cb99e127397a1b47ce0f394c1

                                                    • C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      39ce078e8235b26c5dfd7055c8456d15

                                                      SHA1

                                                      af2d88ce4c0c169c948e9577331a092b4eac86b1

                                                      SHA256

                                                      9347f0c4475aac09fbc71797e08fb0bd1311d4c298ebe11f5a39efb19c0760fe

                                                      SHA512

                                                      ae1334c404ae316f03f47fe9da3236e6b339c9009be5e3c9845cb4dfcca56046e1f5035f0841a4273c250ab59570c7eabd1281adcddf62092d8dbbfb64b6daef

                                                    • C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      28a66fad41b7103492de3f05b7ed9f41

                                                      SHA1

                                                      d196c569c5a551d56410c4ab76e0ee43259618f8

                                                      SHA256

                                                      ded3ef7c72dfbc15d61e7d5fbff76f8a708aa400661c38361f91572388bb9f64

                                                      SHA512

                                                      69d83f9d3975696edbb318401283b06d0165f2440fe1a67188f9d010029edb1fd3686c2aaf4242acf451bf21493c0a2add5e138b3d0b3546bc7e5d40b41f4741

                                                    • C:\Users\Admin\AppData\Local\Temp\RaUzDWAd8R.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      fbf80040a597ba75e3bec89f983b5ffa

                                                      SHA1

                                                      7baac7f5ec395b0f5c68f5a32f4af7e9c74b3e2f

                                                      SHA256

                                                      45f39e0d768598dc29e3648b2191e1e9d8106d823ec76f12943099440744e3ac

                                                      SHA512

                                                      add9d9937cd1197dea5c34f0e270e26922936fdfc29a50785019a136600648dedc6d1dbef8dcfb2afcca7952517ab03171b60ce7208e541feff4ae1e19ff1fd6

                                                    • C:\Users\Admin\AppData\Local\Temp\Vm1YR7N0Qf.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      2a6a3306c90914c05b95339472aa4050

                                                      SHA1

                                                      dbd5efb2d4ae7508ae9aa4891aa91ffb94f6da44

                                                      SHA256

                                                      b663ccf2df17044bf272bca0b8cfd076b8cae541dcb5645985fa29f085e53b73

                                                      SHA512

                                                      22462b2294b56fcc47b05124db1c818ea38bf12e3665530a31150d3b02a770d71384928a7def37a00fbc19b6ee1dfcc1030588ce4757aeecdff5f792707254e5

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3oxtgit.lnr.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      4c450079782c95e868dbd94c3b6f88a3

                                                      SHA1

                                                      2c38042eb2df2c66ad9b4a3acea99d680f89ad36

                                                      SHA256

                                                      5469f3e66bbb7503fb7c7e214c64381deada26d4ceedc30d769021aea19ad7a7

                                                      SHA512

                                                      18d80508dc9f7623bdae11c74eafefc4a6244585e15249de2db7b6abeace18325460b30cc07613b92bf16ec71619c091e432f37e2aff4161cb45f4c573d9bcc9

                                                    • C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      9fbebda6d2c9be5cd1edc65b439e2939

                                                      SHA1

                                                      64ea1f9b0aa922fb8c2fc7f888fc643405b174f2

                                                      SHA256

                                                      8d15f040d8e40e58a13555ab6c002ca7bcf8c75e80175ae8c84a1c1b4bd3b050

                                                      SHA512

                                                      745d90fd350874fbfb755a1ff1d714164a6b3cc685ce41a3ecf5b92c31d803caa04fd1823bd79ef1d29e245588d3248e4ffef4c9a2335974e83aa3b442b4fd08

                                                    • C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat

                                                      Filesize

                                                      204B

                                                      MD5

                                                      eca01ee412cfb05ae1dfbe48370edd61

                                                      SHA1

                                                      404103fbb0f525b46f8a129e36813bf690c04d30

                                                      SHA256

                                                      5f98bd8f6ddd90a96619d08f3af40809f68cabc3b13a52bf42cd4713f3b79a4d

                                                      SHA512

                                                      fc2e7c074e46bf80d182a01b945314468619671c249d41cc5b409c335c054bb94640bf4d50fb66e62df658e4146153b9d23cbd7090c23742c8958d99761373ef

                                                    • C:\providercommon\1zu9dW.bat

                                                      Filesize

                                                      36B

                                                      MD5

                                                      6783c3ee07c7d151ceac57f1f9c8bed7

                                                      SHA1

                                                      17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                      SHA256

                                                      8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                      SHA512

                                                      c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                    • C:\providercommon\DllCommonsvc.exe

                                                      Filesize

                                                      1.0MB

                                                      MD5

                                                      bd31e94b4143c4ce49c17d3af46bcad0

                                                      SHA1

                                                      f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                      SHA256

                                                      b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                      SHA512

                                                      f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                    • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                      Filesize

                                                      197B

                                                      MD5

                                                      8088241160261560a02c84025d107592

                                                      SHA1

                                                      083121f7027557570994c9fc211df61730455bb5

                                                      SHA256

                                                      2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                      SHA512

                                                      20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                    • memory/884-279-0x000000001ADF0000-0x000000001AE02000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/1588-265-0x000000001BFF0000-0x000000001C002000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2400-317-0x000000001AFF0000-0x000000001B002000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2688-17-0x000000001B700000-0x000000001B70C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2688-14-0x000000001AFC0000-0x000000001AFD2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2688-13-0x00000000002B0000-0x00000000003C0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2688-16-0x000000001AFD0000-0x000000001AFDC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2688-12-0x00007FFEC8AD3000-0x00007FFEC8AD5000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/2688-15-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/3192-330-0x000000001B5F0000-0x000000001B602000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/3532-298-0x000000001ADF0000-0x000000001AE02000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/4408-56-0x000001D5BF820000-0x000001D5BF842000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/5060-272-0x000000001B9F0000-0x000000001BA02000-memory.dmp

                                                      Filesize

                                                      72KB