Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 19:52

General

  • Target

    JaffaCakes118_dcc9632d583e049a72ccf3dd2d7421194bbd2d731a346bd646449e1cda95f8c5.exe

  • Size

    1.3MB

  • MD5

    fb8cc415eec439b5e9de7a180bb59356

  • SHA1

    28277d0f2a99492ebf4c543cca37f855046278ae

  • SHA256

    dcc9632d583e049a72ccf3dd2d7421194bbd2d731a346bd646449e1cda95f8c5

  • SHA512

    ab70c2e461c2d2674a92753d0ad5529587e29e85bd7e42c4e5a6f7ff760e7af1e60f9e4d0f37fd5a0c404704c41730efab40fc13730056a4e91c7443d3b63e02

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 31 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 16 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcc9632d583e049a72ccf3dd2d7421194bbd2d731a346bd646449e1cda95f8c5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcc9632d583e049a72ccf3dd2d7421194bbd2d731a346bd646449e1cda95f8c5.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1468
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4228
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1392
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1968
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5040
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:404
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4060
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\Local\Temporary Internet Files\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3548
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RQPdRtTkQ4.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:532
              • C:\providercommon\DllCommonsvc.exe
                "C:\providercommon\DllCommonsvc.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2516
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3036
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1052
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\locale\System.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4140
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4748
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\System.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4572
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\RuntimeBroker.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4976
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\taskhostw.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2060
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\csrss.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3068
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\unsecapp.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4304
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SppExtComObj.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1940
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2772
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2104
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\services.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2888
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WaaSMedicAgent.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1716
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\services.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2128
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\RuntimeBroker.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2696
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\sysmon.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3180
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\System.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:704
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2132
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QRUQZzDytF.bat"
                  7⤵
                    PID:1744
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      8⤵
                        PID:5624
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5228
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2RP5SY0RjS.bat"
                          9⤵
                            PID:5440
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              10⤵
                                PID:5488
                              • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                10⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3400
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat"
                                  11⤵
                                    PID:4516
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      12⤵
                                        PID:1380
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                        12⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5912
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Po3x2tXZG.bat"
                                          13⤵
                                            PID:4852
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              14⤵
                                                PID:6064
                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                14⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2256
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat"
                                                  15⤵
                                                    PID:4980
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      16⤵
                                                        PID:2572
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                        16⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4504
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat"
                                                          17⤵
                                                            PID:2208
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              18⤵
                                                                PID:5984
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                18⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:100
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat"
                                                                  19⤵
                                                                    PID:5724
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      20⤵
                                                                        PID:5980
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                        20⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:656
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat"
                                                                          21⤵
                                                                            PID:3676
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              22⤵
                                                                                PID:3516
                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                                22⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4544
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\evbbIz777a.bat"
                                                                                  23⤵
                                                                                    PID:4956
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      24⤵
                                                                                        PID:1992
                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                                        24⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5804
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JFTIgCVObE.bat"
                                                                                          25⤵
                                                                                            PID:1232
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              26⤵
                                                                                                PID:4120
                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                                                26⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:6140
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RE4R3BzSze.bat"
                                                                                                  27⤵
                                                                                                    PID:2720
                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                      28⤵
                                                                                                        PID:5728
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                                                        28⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1496
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dk6czFnjgV.bat"
                                                                                                          29⤵
                                                                                                            PID:5460
                                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                              30⤵
                                                                                                                PID:5268
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                                                                30⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5300
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WqeaogqjWu.bat"
                                                                                                                  31⤵
                                                                                                                    PID:1272
                                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                      32⤵
                                                                                                                        PID:5524
                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe"
                                                                                                                        32⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4552
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3IH1xDWFpP.bat"
                                                                                                                          33⤵
                                                                                                                            PID:3588
                                                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                              34⤵
                                                                                                                                PID:5700
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\conhost.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4056
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\conhost.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4776
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\de-DE\conhost.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2600
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Links\winlogon.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3068
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Links\winlogon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2704
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Links\winlogon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5052
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\winlogon.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3456
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\winlogon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5112
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\winlogon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:3772
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:400
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:3640
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2468
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\LocalLow\RuntimeBroker.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:840
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\RuntimeBroker.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:880
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\LocalLow\RuntimeBroker.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3208
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:3768
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2128
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:4896
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\cmd.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3140
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:852
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2688
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\providercommon\Registry.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4240
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4528
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1324
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\providercommon\upfc.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:384
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1860
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1204
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:744
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3160
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\upfc.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4820
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default\AppData\Local\Temporary Internet Files\Registry.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:3024
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\AppData\Local\Temporary Internet Files\Registry.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1436
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\AppData\Local\Temporary Internet Files\Registry.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4964
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2912
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4492
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\winlogon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2188
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\lsass.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1236
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\lsass.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:64
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\lsass.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4348
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\spoolsv.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:432
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\spoolsv.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:1524
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\spoolsv.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2572
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\providercommon\System.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4124
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2884
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5040
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\locale\System.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1056
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\System.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2720
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\locale\System.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1204
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4892
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:1608
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:1268
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\My Documents\System.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2204
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\System.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:1548
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\My Documents\System.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3640
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Oracle\RuntimeBroker.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4288
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\RuntimeBroker.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2528
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Oracle\RuntimeBroker.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:3308
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\taskhostw.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2684
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\twain_32\taskhostw.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3404
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\twain_32\taskhostw.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2964
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\ja-JP\csrss.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:640
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:3400
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2124
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\unsecapp.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:4480
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\unsecapp.exe'" /rl HIGHEST /f
                                                              1⤵
                                                                PID:4076
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\unsecapp.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:456
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SppExtComObj.exe'" /f
                                                                1⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3156
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SppExtComObj.exe'" /rl HIGHEST /f
                                                                1⤵
                                                                  PID:3736
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SppExtComObj.exe'" /rl HIGHEST /f
                                                                  1⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:4724
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe'" /f
                                                                  1⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:3236
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe'" /rl HIGHEST /f
                                                                  1⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:3660
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\explorer.exe'" /rl HIGHEST /f
                                                                  1⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:2648
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
                                                                  1⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:1968
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                                  1⤵
                                                                    PID:3676
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2408
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\services.exe'" /f
                                                                    1⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4780
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\services.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2920
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\services.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                      PID:2332
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WaaSMedicAgent.exe'" /f
                                                                      1⤵
                                                                        PID:2892
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WaaSMedicAgent.exe'" /rl HIGHEST /f
                                                                        1⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:904
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WaaSMedicAgent.exe'" /rl HIGHEST /f
                                                                        1⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:3784
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\services.exe'" /f
                                                                        1⤵
                                                                          PID:2744
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\services.exe'" /rl HIGHEST /f
                                                                          1⤵
                                                                            PID:1240
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\services.exe'" /rl HIGHEST /f
                                                                            1⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:3024
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
                                                                            1⤵
                                                                              PID:3004
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:3460
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:2584
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\sysmon.exe'" /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:4092
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\sysmon.exe'" /rl HIGHEST /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:3448
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\ReadyBoot\sysmon.exe'" /rl HIGHEST /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:4504
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\en-US\System.exe'" /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:3280
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\System.exe'" /rl HIGHEST /f
                                                                              1⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:3408
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\en-US\System.exe'" /rl HIGHEST /f
                                                                              1⤵
                                                                                PID:452
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'" /f
                                                                                1⤵
                                                                                  PID:2008
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                  1⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:3904
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                  1⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:2512

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  7f3c0ae41f0d9ae10a8985a2c327b8fb

                                                                                  SHA1

                                                                                  d58622bf6b5071beacf3b35bb505bde2000983e3

                                                                                  SHA256

                                                                                  519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                                                                  SHA512

                                                                                  8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  baf55b95da4a601229647f25dad12878

                                                                                  SHA1

                                                                                  abc16954ebfd213733c4493fc1910164d825cac8

                                                                                  SHA256

                                                                                  ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                                                  SHA512

                                                                                  24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                                                  SHA1

                                                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                  SHA256

                                                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                  SHA512

                                                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  77d622bb1a5b250869a3238b9bc1402b

                                                                                  SHA1

                                                                                  d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                  SHA256

                                                                                  f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                  SHA512

                                                                                  d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  2e907f77659a6601fcc408274894da2e

                                                                                  SHA1

                                                                                  9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                  SHA256

                                                                                  385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                  SHA512

                                                                                  34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  cadef9abd087803c630df65264a6c81c

                                                                                  SHA1

                                                                                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                                                  SHA256

                                                                                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                                                  SHA512

                                                                                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  d28a889fd956d5cb3accfbaf1143eb6f

                                                                                  SHA1

                                                                                  157ba54b365341f8ff06707d996b3635da8446f7

                                                                                  SHA256

                                                                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                                  SHA512

                                                                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  bd5940f08d0be56e65e5f2aaf47c538e

                                                                                  SHA1

                                                                                  d7e31b87866e5e383ab5499da64aba50f03e8443

                                                                                  SHA256

                                                                                  2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                                                  SHA512

                                                                                  c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  dd1d0b083fedf44b482a028fb70b96e8

                                                                                  SHA1

                                                                                  dc9c027937c9f6d52268a1504cbae42a39c8d36a

                                                                                  SHA256

                                                                                  cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

                                                                                  SHA512

                                                                                  96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  4c557aa00dc4a6ff86db4be1735e9d30

                                                                                  SHA1

                                                                                  7c155ad08e280926832bdad0aa948843de2ce5a2

                                                                                  SHA256

                                                                                  aad198f453bdcef5e479c7e622c005782f94d0b391798245284aad9506fa7e48

                                                                                  SHA512

                                                                                  2c311b272941308197e3f2fe9d961dda9682dfd514cc48bc63b156afb0d18cace8635f0d080b9f77ed43e67b551232a6fb5b86e88c2414f8bd2f32cbe5521ae2

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  9006afb2f47b3bb7d3669c647651e29c

                                                                                  SHA1

                                                                                  cdc0d7654be8e516df2c36accd9b52eac1f00ffd

                                                                                  SHA256

                                                                                  a025443b35555d64473b1ef01194239e808c49b47c924b99b942514036901302

                                                                                  SHA512

                                                                                  f2e72bbecfa823415bd0be7a091b1272e10e11059a71baf115780aa7ce3e694d114f6642de161ccba24e2182765b8188cc6dbb804fd07e318af9e1917549841c

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  75b5bc86e6b72b4df51cc3146247a2b4

                                                                                  SHA1

                                                                                  bb90d920350bb158cd370f7188953eba4a1a4f03

                                                                                  SHA256

                                                                                  f44f98f21d49a01e043dbdc2ca0f6c020a98ce4aa583d416bff5d6ce63ff4625

                                                                                  SHA512

                                                                                  57bafbaedcced9205cc460ff7bd682b2cb2ac6190a0edb841bdf09bcdd172d47954801dbcfd7bb0312e871a11c9538e520bc353037e6aceb540ee39f01ea6400

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  b801d886e417a9bf405b2f0092e04fe1

                                                                                  SHA1

                                                                                  fa99fefa2f49af240141692f78c8c28f04205389

                                                                                  SHA256

                                                                                  57b1c29eef54567fcfdaa28d2923485cb6f77bb76dc54235965fb34f02a42636

                                                                                  SHA512

                                                                                  b2c8bf95b4c25d7fff388b5f3e04212c43af9588f7aed8a7cb251330ee18c89789eb1d294b8449ec2afeb9b5373d7a6dce8f4369b84cbfb6a7c7813341fa07ff

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  0f6a77860cd9c5289dd6e45bbc36a982

                                                                                  SHA1

                                                                                  750d55b0d394bc5716fc3e3204975b029d3dc43b

                                                                                  SHA256

                                                                                  a8388051b43fdc7a50ee51047ef4076c4b6502a6e53befe8131efcb71aa700a4

                                                                                  SHA512

                                                                                  e4e4473383243a71d7bebffb8bf4bf449201e1aee752426044e81bdc12c3aaf284ce003a859b0ac96d5fd75063376485dc5b5ac0caad189577bf394f104cdd06

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  08526e4d8fed0a382c243c9aa8b1fe45

                                                                                  SHA1

                                                                                  f3da4b97529aaa38230db8bfa34a345bbc211622

                                                                                  SHA256

                                                                                  b5044625d66b7835745c7c4efa14d21aaf4ee42bf971f8bbc44f04416b91441f

                                                                                  SHA512

                                                                                  cbeb569db60eabd89c13b073f1bdf7ba991b6206e75f548396a150b08a0ffed1962d88d664e069c64ac740afbb69941df2f43e81a3f138e2185934967898941d

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  bc113211a3e72478c93989952aee3251

                                                                                  SHA1

                                                                                  5eeb2f2e4642ef5f147dd118742ea3c3dcf0cd16

                                                                                  SHA256

                                                                                  c6059355503eca5b35ac8446442eb5031ab610b7353cd2e8a3cf07dc99469fae

                                                                                  SHA512

                                                                                  c0748cc3a4b701f5cefeeaf9ac1bdbae28cfcf1dad8e89a2db2c756b908011ee8e945b6d02bef816763fc5acc38a72657316f5cd56c62342c8e779a50f4f4460

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  6bf2927575032d77fab2956579e56348

                                                                                  SHA1

                                                                                  55bfbdacbf4a787b232793f19eca4df667722621

                                                                                  SHA256

                                                                                  a8f97ad6d46dc8b95328e3d85c48451537b2c71855a5913f7b2f3305dab0b6f0

                                                                                  SHA512

                                                                                  7649c7f3c6d753ce6d374798f1f9e0bc6aa84fd445407bd0a0a4cfaa6f48c5d54deb0c836b39b5104c9e82922c0daa84fe824c43f84ae89860c7d1c68610decc

                                                                                • C:\Users\Admin\AppData\Local\Temp\2RP5SY0RjS.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  6f7f8386d880358217ce0b5f1d6273e8

                                                                                  SHA1

                                                                                  b79635e13f1e6bc9eed107f191ff83de3a35f954

                                                                                  SHA256

                                                                                  11c7a7793daaa8fc52647a4e2db3b870220d9d50387e56cdace1151e53f6f0db

                                                                                  SHA512

                                                                                  c73e53d8f229fdb80e0e77e2f349b5022c6efab61314968efb173ec5e6daa92e0d5b59139e36b7b6aaa0def5dd8a8eea1a15f587f1afd5c07c95be1174eb10ae

                                                                                • C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  27489c88b331706b58498709d734abc7

                                                                                  SHA1

                                                                                  3e5c0b53f1602ad57df9ffa43e8f1c54e9fe1df7

                                                                                  SHA256

                                                                                  e42a2e48b082c03028e5caaa4e193441587feea7e8b8923794bb63a9aa33dd67

                                                                                  SHA512

                                                                                  27399e3cada4d390eea1b0355612106f15022669494f592af0aaf2bccf07e6e09b6589afb90d5f1f562c94713b226675b543a3f934b85d55ffa19fc11da024f7

                                                                                • C:\Users\Admin\AppData\Local\Temp\6Po3x2tXZG.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  b0716b3f9e4bd17903e9cf2be5b17c93

                                                                                  SHA1

                                                                                  d04c901f56bb35655d85c3e8579318d03522955b

                                                                                  SHA256

                                                                                  78fa5d0f599d0dc4436a4510bb7f9ef8ca27f33122c51691230f3957e9125bd3

                                                                                  SHA512

                                                                                  f5da3061427cc0ac75950ff3e649c72a4e3b7f7d1cb05b7f878c87fe437697e1af35db8317779456a1ff8297e516308122243b8cb125664a9242c481f0ce05fe

                                                                                • C:\Users\Admin\AppData\Local\Temp\8Lq6d7xQt2.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  1d1449f6b615d386460cca2e09101003

                                                                                  SHA1

                                                                                  fc81e2820a72f24b86e774811f97cf15be275b00

                                                                                  SHA256

                                                                                  cec39a4cb6c6797677d39126593ff3e7515ef179e649103a65a3328877019be0

                                                                                  SHA512

                                                                                  b34b29bd9b0354c375f1c3058499501d24bc77af760515faca4842da326f3b536107555fa81391e1286b805023ac2fe0907ea0fa8ed6cdb199bb6ada6c2dca0f

                                                                                • C:\Users\Admin\AppData\Local\Temp\JFTIgCVObE.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  4eb5e5b3726a2fc9c36f5bbc523e07d1

                                                                                  SHA1

                                                                                  29e904b3595e58bc9cdf6a30b0e0d65e42dc1c70

                                                                                  SHA256

                                                                                  0e2eac12075e328dc3d9495efd811758d444c3929dfdfda8f8a718490d0dedb1

                                                                                  SHA512

                                                                                  859b72760208a909fb04ce143de07b5621ea6e9ec3f037b314bdf07c320b85d8cc1da1a9b384cba7af01538aa44691e3d593c76b46b6561673c64f36b5face7e

                                                                                • C:\Users\Admin\AppData\Local\Temp\QRUQZzDytF.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  1cfdca16d6f6be802e137a7a0295707d

                                                                                  SHA1

                                                                                  e40cd5da25a83641a9ef98c955efb656134303a8

                                                                                  SHA256

                                                                                  8b5e8bc720a5e32c832974c854c8e45e6b31873a87b0f00982b074e1eedc959b

                                                                                  SHA512

                                                                                  846753de7a053db354a0d0099149e3544134c2f8b19b47e8402339071f42bfc27bc8b5c1b2fbcc49dfa3fbfa7172df9fb764fb55eeb9b74e1696dd90a690cd69

                                                                                • C:\Users\Admin\AppData\Local\Temp\RE4R3BzSze.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  a9e7c2412a85a5fdc95301acb0ea4ea1

                                                                                  SHA1

                                                                                  1f73ec2a7ea193f71e7b4cd6148f1cee2960c2f7

                                                                                  SHA256

                                                                                  9e4c6c9eacbdca94fa35adfe793e349ed3f6c9486b97df952a746670aa9f0964

                                                                                  SHA512

                                                                                  1e73941587bd46614d6341927c1821cc1b0f25b1f479dfcf9b5996550517466b99717cc5de9dabdc71bc3cfcb999e1fcc32e29082b759beaa9115aedb9df51e7

                                                                                • C:\Users\Admin\AppData\Local\Temp\RQPdRtTkQ4.bat

                                                                                  Filesize

                                                                                  199B

                                                                                  MD5

                                                                                  9c927ac8fb5c8729e6f64ca512e16903

                                                                                  SHA1

                                                                                  c29835097425d51a89033dc13bbcc01c77a83ebc

                                                                                  SHA256

                                                                                  f3697c029f9c1c2fa50c61d5646a3f965be79199590ce14e6cce4ed0ee4616ed

                                                                                  SHA512

                                                                                  88665d671baca22e2572b7783c4decb5b1be219cf7d6e10b2d3de19551ab43524e11d054fea2cea0c24cbd585562ad70a0bd39e8585cb5a29115f7ff7fbb88cc

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdcupq0i.pox.ps1

                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                • C:\Users\Admin\AppData\Local\Temp\evbbIz777a.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  5cfddadf360f20117a4b55f187fbe970

                                                                                  SHA1

                                                                                  f4d2a000ab5f000eca44027657a85df80fe7266e

                                                                                  SHA256

                                                                                  1af86b042c571ccb1d060c05e19827eb8f2c2622c48afbb11b5b7cd34e2530b7

                                                                                  SHA512

                                                                                  ff9aa3456da69b788efacc4d2660a79fc0cfec9d065a19b73d18f29b955c01d30fce3095cfa81dc14c43b7d138fddc58243130e924ad64ac8a5c23e72a50539f

                                                                                • C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  ce3a1ef6a93e11e7b19eda3c658d8dbb

                                                                                  SHA1

                                                                                  a9b2b082c7ff7efcfe8c7c1698e3069256dc3a44

                                                                                  SHA256

                                                                                  23d225e8a16ffce3ccc05b0ef0c0e800d8c8e5661512cadc98a6d034cc698878

                                                                                  SHA512

                                                                                  21bbea2a716967f8c0b3b466e4305209486a9941f6b605d5691cceaaa6a54857b34d1881f2e4f36e9d8782afb5abb8d237d6ab46122752ed11787be3b2c23a3d

                                                                                • C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat

                                                                                  Filesize

                                                                                  232B

                                                                                  MD5

                                                                                  0510bcde0ceb8a711d17dc45df1c14d6

                                                                                  SHA1

                                                                                  270c09c3c1b3392d3bb72ee9e63bd104189125b1

                                                                                  SHA256

                                                                                  86b57fb531a336109d12a4e9d55fe361fbf1df8db7cebd5083dc3f152c047595

                                                                                  SHA512

                                                                                  a3e99ab44af2cf6a037e183bf7f3b0f1c6e26d454133cad11dcf29fe5b02b75829cbe6e846a2bc3436f083ef245a903b3bc94d819159167807d66d9d475ec171

                                                                                • C:\providercommon\1zu9dW.bat

                                                                                  Filesize

                                                                                  36B

                                                                                  MD5

                                                                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                                                                  SHA1

                                                                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                                                  SHA256

                                                                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                                                  SHA512

                                                                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                                                • C:\providercommon\DllCommonsvc.exe

                                                                                  Filesize

                                                                                  1.0MB

                                                                                  MD5

                                                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                                                  SHA1

                                                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                                                  SHA256

                                                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                                                  SHA512

                                                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                                                  Filesize

                                                                                  197B

                                                                                  MD5

                                                                                  8088241160261560a02c84025d107592

                                                                                  SHA1

                                                                                  083121f7027557570994c9fc211df61730455bb5

                                                                                  SHA256

                                                                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                                                  SHA512

                                                                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                                                • memory/1716-13-0x0000000000BB0000-0x0000000000CC0000-memory.dmp

                                                                                  Filesize

                                                                                  1.1MB

                                                                                • memory/1716-12-0x00007FFFFBCA3000-0x00007FFFFBCA5000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                • memory/1716-14-0x0000000002DC0000-0x0000000002DD2000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                • memory/1716-15-0x0000000002DF0000-0x0000000002DFC000-memory.dmp

                                                                                  Filesize

                                                                                  48KB

                                                                                • memory/1716-16-0x0000000002DD0000-0x0000000002DDC000-memory.dmp

                                                                                  Filesize

                                                                                  48KB

                                                                                • memory/1716-17-0x0000000002DE0000-0x0000000002DEC000-memory.dmp

                                                                                  Filesize

                                                                                  48KB

                                                                                • memory/2516-221-0x0000000001680000-0x0000000001692000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                • memory/4504-501-0x0000000001070000-0x0000000001082000-memory.dmp

                                                                                  Filesize

                                                                                  72KB

                                                                                • memory/5040-60-0x000002096AA20000-0x000002096AA42000-memory.dmp

                                                                                  Filesize

                                                                                  136KB