Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 21:21

General

  • Target

    JaffaCakes118_906917d2c4c796abf6ebf5371c4f2e82eaba54631370ee9b3824f296ddc253f0.exe

  • Size

    1.3MB

  • MD5

    3b2f49271a249736b26e909d0709b0b7

  • SHA1

    09be02d46117068a2ec875a97a05664fcb73f408

  • SHA256

    906917d2c4c796abf6ebf5371c4f2e82eaba54631370ee9b3824f296ddc253f0

  • SHA512

    5944e1fb52b02a5ddaf84de47a3bf30c4178270ce0a61914b29020876ecfab6ec28411dfa15e0bff85ef227061c5f690a3c6635072aed28cda9dd69a041e0a5c

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_906917d2c4c796abf6ebf5371c4f2e82eaba54631370ee9b3824f296ddc253f0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_906917d2c4c796abf6ebf5371c4f2e82eaba54631370ee9b3824f296ddc253f0.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3676
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Sun\Java\Deployment\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:412
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4236
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5084
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1904
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3880
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:392
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4800
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1120
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3300
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nOXMgtbINX.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4584
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:2860
              • C:\Users\Default User\winlogon.exe
                "C:\Users\Default User\winlogon.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2148
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rE1HJofSUb.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3264
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2064
                    • C:\Users\Default User\winlogon.exe
                      "C:\Users\Default User\winlogon.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:532
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1820
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:4336
                          • C:\Users\Default User\winlogon.exe
                            "C:\Users\Default User\winlogon.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1000
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3060
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:980
                                • C:\Users\Default User\winlogon.exe
                                  "C:\Users\Default User\winlogon.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5064
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mMyBvdYgq2.bat"
                                    13⤵
                                      PID:1888
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        14⤵
                                          PID:4520
                                        • C:\Users\Default User\winlogon.exe
                                          "C:\Users\Default User\winlogon.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2160
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MpmmxgpAh8.bat"
                                            15⤵
                                              PID:4296
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                16⤵
                                                  PID:3132
                                                • C:\Users\Default User\winlogon.exe
                                                  "C:\Users\Default User\winlogon.exe"
                                                  16⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3832
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat"
                                                    17⤵
                                                      PID:1368
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        18⤵
                                                          PID:1732
                                                        • C:\Users\Default User\winlogon.exe
                                                          "C:\Users\Default User\winlogon.exe"
                                                          18⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:624
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat"
                                                            19⤵
                                                              PID:2140
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                20⤵
                                                                  PID:4808
                                                                • C:\Users\Default User\winlogon.exe
                                                                  "C:\Users\Default User\winlogon.exe"
                                                                  20⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3884
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cu9aubHCzw.bat"
                                                                    21⤵
                                                                      PID:2392
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        22⤵
                                                                          PID:2904
                                                                        • C:\Users\Default User\winlogon.exe
                                                                          "C:\Users\Default User\winlogon.exe"
                                                                          22⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1680
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat"
                                                                            23⤵
                                                                              PID:5068
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                24⤵
                                                                                  PID:1352
                                                                                • C:\Users\Default User\winlogon.exe
                                                                                  "C:\Users\Default User\winlogon.exe"
                                                                                  24⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4040
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat"
                                                                                    25⤵
                                                                                      PID:4848
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        26⤵
                                                                                          PID:2016
                                                                                        • C:\Users\Default User\winlogon.exe
                                                                                          "C:\Users\Default User\winlogon.exe"
                                                                                          26⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4652
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat"
                                                                                            27⤵
                                                                                              PID:2312
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                28⤵
                                                                                                  PID:4832
                                                                                                • C:\Users\Default User\winlogon.exe
                                                                                                  "C:\Users\Default User\winlogon.exe"
                                                                                                  28⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5084
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat"
                                                                                                    29⤵
                                                                                                      PID:824
                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                        30⤵
                                                                                                          PID:3376
                                                                                                        • C:\Users\Default User\winlogon.exe
                                                                                                          "C:\Users\Default User\winlogon.exe"
                                                                                                          30⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5008
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uLZJId2lFR.bat"
                                                                                                            31⤵
                                                                                                              PID:2032
                                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                32⤵
                                                                                                                  PID:4756
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\explorer.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1928
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\explorer.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1212
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\explorer.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4936
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\RuntimeBroker.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4844
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MSBuild\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2932
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3244
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\sysmon.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2020
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3752
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4692
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:732
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3512
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:468
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1860
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3656
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4912
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\Sun\Java\Deployment\sysmon.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2620
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\sysmon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2124
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Sun\Java\Deployment\sysmon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2848
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3960
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3720
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4724
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4852
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4580
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:776
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\providercommon\System.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:944
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:216
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4732
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:5072
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4444
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:436
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\RuntimeBroker.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2900
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\ssh\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2876
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1668
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1548
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3308
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:5064
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4316
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:316
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3868
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2188
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2892
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3264
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2780
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1264
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1372
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2156
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1188
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4532

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                    SHA1

                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                    SHA256

                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                    SHA512

                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    baf55b95da4a601229647f25dad12878

                                                    SHA1

                                                    abc16954ebfd213733c4493fc1910164d825cac8

                                                    SHA256

                                                    ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                    SHA512

                                                    24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    6d3e9c29fe44e90aae6ed30ccf799ca8

                                                    SHA1

                                                    c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                    SHA256

                                                    2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                    SHA512

                                                    60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    3a6bad9528f8e23fb5c77fbd81fa28e8

                                                    SHA1

                                                    f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                    SHA256

                                                    986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                    SHA512

                                                    846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    22fbec4acba323d04079a263526cef3c

                                                    SHA1

                                                    eb8dd0042c6a3f20087a7d2391eaf48121f98740

                                                    SHA256

                                                    020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

                                                    SHA512

                                                    fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    cadef9abd087803c630df65264a6c81c

                                                    SHA1

                                                    babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                    SHA256

                                                    cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                    SHA512

                                                    7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    bd5940f08d0be56e65e5f2aaf47c538e

                                                    SHA1

                                                    d7e31b87866e5e383ab5499da64aba50f03e8443

                                                    SHA256

                                                    2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                    SHA512

                                                    c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    120B

                                                    MD5

                                                    d880eb32227ec8b4dc9f4c3c07030c8a

                                                    SHA1

                                                    96fb1579ea3fad14d856c1d444dcf0958dc28019

                                                    SHA256

                                                    9c64cc23874bcd11b4888e153881ed08da7b8575b01d6709b9b57b677b95a631

                                                    SHA512

                                                    cd5070b8d80d7407ccbecd9a0e8d0a81b23485304318d5174b39d90aa0c4d16ce4b380d4d37bd38be027428d9fb89a5c0677fb2b93f443347bc682493b94f880

                                                  • C:\Users\Admin\AppData\Local\Temp\Cu9aubHCzw.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    1a98116fc655ee0d7fabe04d08bb62db

                                                    SHA1

                                                    2ec7be140a8286ec880fc4a60a1c4685a798ea99

                                                    SHA256

                                                    01e33320cfd92173a3c6e44176a1765986e91ad207c1fcac8df89fb21ce0f0f0

                                                    SHA512

                                                    a07b3dab340b1d36c2ffcf970fe7eb9863102f19211b8d8999cb5b0c34eaf9d6075570f6b842c9380c9b72177ef57a9692c993b66ab8fed910a3b2cc61806641

                                                  • C:\Users\Admin\AppData\Local\Temp\MpmmxgpAh8.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    4cc93fd39c42deb6aa3dbbad4ff9adf6

                                                    SHA1

                                                    9a9f08179a35e90007e20b8a7de057c32a525420

                                                    SHA256

                                                    923c46d1fbf34bb178ae797a3c6dbc11858c5a6ada539674ca71ddb88f0c5050

                                                    SHA512

                                                    f7d712b3d0d06f3338c4e89ff3c0aaec8562963b7004b6fa17793c2dda20eda308c9a0cdec78cbd26ee69fb418c65ef55adcb1189e75c58a7580f65ffcbd6ac7

                                                  • C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    984f6da126903dbac00d857185653ab6

                                                    SHA1

                                                    88909160c440e601f25b79f2796fd92971a92fab

                                                    SHA256

                                                    c2c79ad2daa3578812c768c69b8ade7d22eab50f472a395f235d73b387b970e0

                                                    SHA512

                                                    e817b7dd7753cf6816e57f54206a73705b9c2aa9cd7aef85838c3576b5469d77ebb61b69f508a1e68402bb58f8557d896278a6e6a4f98ce2d5d3da19f7a64d55

                                                  • C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    0db64d5597c0ea7227a74d79321b4a7f

                                                    SHA1

                                                    718c6e6dd74934a947b2fc9c6875b5a95b90e675

                                                    SHA256

                                                    ba04917baf5577e60a86cb4c92922cbb809afe105e712022f00b73e7161f1703

                                                    SHA512

                                                    5c02d25c951f489e12509664eb01faeae49323df118ef500c576c498baef4200fdf8cf01dee9dc088c05207d8647591117b160a6aa7c922b64179d722a114bdc

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dtum2riz.ovp.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    1017922763f300c4f153bd527b6b3412

                                                    SHA1

                                                    aaccac15a8b6c1a3c11687f530da71d4943c19f3

                                                    SHA256

                                                    351b2cdd0d3ff7723d7e38b0c38081b9e98674577bea53c92ea1ef9c62672ad2

                                                    SHA512

                                                    f40e2621a761f481a07dee04430c5bc93b2d14a388328cde882ad8ede1a021c6242c0915ffb97afa874a56a65d9b3494c540658bc3ea4f5acf82a3be7693ebef

                                                  • C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    d07be5754ee4bc02d704fd0d4533e2f8

                                                    SHA1

                                                    916c8e9872651c9124e72dddba7902bdc4345ea4

                                                    SHA256

                                                    b8b0410196603f61a4265c48b2718dfbb61a5207976015c2c6fb0c6106af3144

                                                    SHA512

                                                    be1896fe7416a7725319d892b63f6e042eae50feae554becc63c934bedd95db36d25ba5e273adc552791ae65bd4d2761a0eda9e0c246c5d92e9659a04ab11f9c

                                                  • C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    ecc15e93be0b53703bff29fdc3a586ab

                                                    SHA1

                                                    c060bed0e395793468c38e14b6281dee3d06905f

                                                    SHA256

                                                    88e5614c96c780f1b45363ebb64af4d20c4d39e1227a36d120af2d4972e53d2c

                                                    SHA512

                                                    7eb979f6b53d6bcb9f4ca748390ec5f771c50f283e09ec3da2d32733f006a166b766eeb491f6ed63d49df8dd860f17c0241dbd5df035b5aae1caf68147b4efd9

                                                  • C:\Users\Admin\AppData\Local\Temp\mMyBvdYgq2.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    3fbbc25b45e240dcc9f1564c8f3b2d11

                                                    SHA1

                                                    5e36b73fa7ed832c1612d1beabedff89560257aa

                                                    SHA256

                                                    db748f48cf35a5c3b5b584d73521bf8e6354dd1cefa16270709506e997421d50

                                                    SHA512

                                                    8be029593533ff4d4f3b58a58e441aae2ad1d003ea4d990ea79a72fc7106cc94795bf5143f98a733d104704c959322f08b19eaffad36d1d9688e05c8c18eaf28

                                                  • C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    0a830dee36402daaeca4cfbbfad5d7e3

                                                    SHA1

                                                    65665eb58dc405e8d361419ea13b4e36aba1f3a5

                                                    SHA256

                                                    fd3cab42ca4bffa702428473809af8142965e311f3ead2d58fbd9c1d57b92aee

                                                    SHA512

                                                    20516269710afb59c4fce07a425e8cf0519a21503a8b30da44d467d8115e7ebced56c926fed8d0503a18cd6471f98225b9df3e8a8e191f4c1e0119cd0472bf33

                                                  • C:\Users\Admin\AppData\Local\Temp\nOXMgtbINX.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    1991f6d0932d88c035a78b2bdf2f42d2

                                                    SHA1

                                                    e29e6ad72f1c98efbc18c9c4a22a6b8b2859d801

                                                    SHA256

                                                    85b5c544761dc0987444cded8a9abb43c6b703c75131def0fc4a5c78c5f2b0f2

                                                    SHA512

                                                    32fbda1e6d5335ef49099fdfede62679ee79b11a4cf0670917625102fd66c31ed164dc79ed8126b617d23efcd99cb2e50d89a92cf9fef00dd834e13357a2c981

                                                  • C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    72ecd4be70304a94b5df7b55467bd281

                                                    SHA1

                                                    52f4f14b437b88eca1123ef4c1565bd2af1af9d3

                                                    SHA256

                                                    a653aca6b6a41f8d4f2a53d618d4127b019cc8706f5d58395600fb00cb8dea8b

                                                    SHA512

                                                    e3259f2f5dc3fbf5a191cd810ab36f95ebc1b0d8433db1351c6436a03076da51cd2f8c01d124636ae0ad176e6a8156bdcf54974360635f90fd02c8d05c4f36fb

                                                  • C:\Users\Admin\AppData\Local\Temp\rE1HJofSUb.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    eaf07df0841789bb83bac01745907b8b

                                                    SHA1

                                                    8c109551df6f6b6f2354a82ba5f879b1ef28e06d

                                                    SHA256

                                                    4433531b54c6bd8326d23de0eea1f252b9b4879524494805491e0112793815fc

                                                    SHA512

                                                    1b9d49cadfb3cc30a7dc12fdc1827e4dfc5f3886250c96fa11d6ce854c8d1bb6e47e1e868b9bbfe1621d9e23c299cc21aae03d395c63724d4ee0809635df98da

                                                  • C:\Users\Admin\AppData\Local\Temp\uLZJId2lFR.bat

                                                    Filesize

                                                    199B

                                                    MD5

                                                    113862040a0b4c52e27db6e0f8cd26fd

                                                    SHA1

                                                    c1f59c40ec2856508d4bfde47aa36ca4c07f4c28

                                                    SHA256

                                                    a844848a8a03374ae74e13605e33f8a43e91dd139777b0a800b3bd82279c8cd1

                                                    SHA512

                                                    03314b7a7e1e3beb94597cc5eaf97bcfe1a7c11c6338e377ee7659d733a9c149315414cc8b3ae6786bd83dbfcbbc3861bc1adb5cdd41c416858ba8fb36843c9f

                                                  • C:\providercommon\1zu9dW.bat

                                                    Filesize

                                                    36B

                                                    MD5

                                                    6783c3ee07c7d151ceac57f1f9c8bed7

                                                    SHA1

                                                    17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                    SHA256

                                                    8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                    SHA512

                                                    c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                  • C:\providercommon\DllCommonsvc.exe

                                                    Filesize

                                                    1.0MB

                                                    MD5

                                                    bd31e94b4143c4ce49c17d3af46bcad0

                                                    SHA1

                                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                    SHA256

                                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                    SHA512

                                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                  • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                    Filesize

                                                    197B

                                                    MD5

                                                    8088241160261560a02c84025d107592

                                                    SHA1

                                                    083121f7027557570994c9fc211df61730455bb5

                                                    SHA256

                                                    2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                    SHA512

                                                    20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                  • memory/412-64-0x00000244EA5D0000-0x00000244EA5F2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/2148-246-0x0000000002580000-0x0000000002592000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/2944-17-0x0000000002310000-0x000000000231C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                  • memory/2944-16-0x00000000022F0000-0x00000000022FC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                  • memory/2944-15-0x0000000002300000-0x000000000230C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                  • memory/2944-14-0x00000000022D0000-0x00000000022E2000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/2944-13-0x00000000000D0000-0x00000000001E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2944-12-0x00007FFD21D33000-0x00007FFD21D35000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3884-292-0x0000000002460000-0x0000000002472000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/5064-267-0x0000000001280000-0x0000000001292000-memory.dmp

                                                    Filesize

                                                    72KB