Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 08:21

General

  • Target

    JaffaCakes118_ab49f9520f703ec5ef5267e9be7efdef97591ba0c47c8872038a3ffa35fda55f.exe

  • Size

    1.3MB

  • MD5

    bb99bf46c703958b2b7464055b68ce6d

  • SHA1

    8a1fa2e73df4bb30f8a47129dcca581e244026c3

  • SHA256

    ab49f9520f703ec5ef5267e9be7efdef97591ba0c47c8872038a3ffa35fda55f

  • SHA512

    893f7b6e2c166dd2eff75e57af78ff1622fa7871616dd863b046d97a39a4c2db49fff536b59eae43c8672247d8bd4b495bcb1fed452bf8fe351e976ab1e3f509

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab49f9520f703ec5ef5267e9be7efdef97591ba0c47c8872038a3ffa35fda55f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab49f9520f703ec5ef5267e9be7efdef97591ba0c47c8872038a3ffa35fda55f.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1412
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2212
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\System\it-IT\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2164
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3996
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\Basebrd\de-DE\sihost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4304
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1972
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4692
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2344
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4708
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1604
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3280
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CzxnpQr0Sp.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2484
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:3848
              • C:\Users\Default User\Registry.exe
                "C:\Users\Default User\Registry.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5636
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5904
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:5964
                    • C:\Users\Default User\Registry.exe
                      "C:\Users\Default User\Registry.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:6032
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ww6iFNwlpp.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4820
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:1412
                          • C:\Users\Default User\Registry.exe
                            "C:\Users\Default User\Registry.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3828
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2320
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:5276
                                • C:\Users\Default User\Registry.exe
                                  "C:\Users\Default User\Registry.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2980
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat"
                                    13⤵
                                      PID:2824
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        14⤵
                                          PID:4752
                                        • C:\Users\Default User\Registry.exe
                                          "C:\Users\Default User\Registry.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5032
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pgCyA6Uc1O.bat"
                                            15⤵
                                              PID:432
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                16⤵
                                                  PID:4868
                                                • C:\Users\Default User\Registry.exe
                                                  "C:\Users\Default User\Registry.exe"
                                                  16⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4340
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
                                                    17⤵
                                                      PID:3012
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        18⤵
                                                          PID:5160
                                                        • C:\Users\Default User\Registry.exe
                                                          "C:\Users\Default User\Registry.exe"
                                                          18⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5360
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat"
                                                            19⤵
                                                              PID:5392
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                20⤵
                                                                  PID:5604
                                                                • C:\Users\Default User\Registry.exe
                                                                  "C:\Users\Default User\Registry.exe"
                                                                  20⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2404
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mQXsfud8LV.bat"
                                                                    21⤵
                                                                      PID:2880
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        22⤵
                                                                          PID:5864
                                                                        • C:\Users\Default User\Registry.exe
                                                                          "C:\Users\Default User\Registry.exe"
                                                                          22⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5696
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
                                                                            23⤵
                                                                              PID:5940
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                24⤵
                                                                                  PID:5096
                                                                                • C:\Users\Default User\Registry.exe
                                                                                  "C:\Users\Default User\Registry.exe"
                                                                                  24⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3748
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aoAocY3YSO.bat"
                                                                                    25⤵
                                                                                      PID:6076
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        26⤵
                                                                                          PID:6032
                                                                                        • C:\Users\Default User\Registry.exe
                                                                                          "C:\Users\Default User\Registry.exe"
                                                                                          26⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1408
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
                                                                                            27⤵
                                                                                              PID:2800
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                28⤵
                                                                                                  PID:544
                                                                                                • C:\Users\Default User\Registry.exe
                                                                                                  "C:\Users\Default User\Registry.exe"
                                                                                                  28⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3488
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"
                                                                                                    29⤵
                                                                                                      PID:5256
                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                        30⤵
                                                                                                          PID:3920
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3120
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1648
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3660
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\sysmon.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2312
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\sysmon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2484
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\sysmon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4864
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:384
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:544
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1124
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4044
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1284
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4832
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\it-IT\smss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3668
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\it-IT\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3128
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\System\it-IT\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3920
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Registry.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2932
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4828
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:460
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4688
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:952
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4844
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\Branding\Basebrd\de-DE\sihost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3472
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\de-DE\sihost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5048
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows\Branding\Basebrd\de-DE\sihost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4712
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:112
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3888
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4136
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:824
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4408
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2872
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3052
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:436
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4968
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3828
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3424
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1128
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4804
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3924
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3988
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2704
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2208
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2840
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\cmd.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1424
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\cmd.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4380
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\cmd.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2580
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1636
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:812
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4752

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

                                                Filesize

                                                1KB

                                                MD5

                                                baf55b95da4a601229647f25dad12878

                                                SHA1

                                                abc16954ebfd213733c4493fc1910164d825cac8

                                                SHA256

                                                ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                SHA512

                                                24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                Filesize

                                                2KB

                                                MD5

                                                71fa55c67a762ba70e40011153e19b3c

                                                SHA1

                                                a36d2bb4802a8ec7db1a68de5f0c3d6007987492

                                                SHA256

                                                b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291

                                                SHA512

                                                32760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                6d3e9c29fe44e90aae6ed30ccf799ca8

                                                SHA1

                                                c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                SHA256

                                                2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                SHA512

                                                60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                6d42b6da621e8df5674e26b799c8e2aa

                                                SHA1

                                                ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                SHA256

                                                5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                SHA512

                                                53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                3a6bad9528f8e23fb5c77fbd81fa28e8

                                                SHA1

                                                f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                SHA256

                                                986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                SHA512

                                                846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                e243a38635ff9a06c87c2a61a2200656

                                                SHA1

                                                ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                SHA256

                                                af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                SHA512

                                                4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                2e907f77659a6601fcc408274894da2e

                                                SHA1

                                                9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                SHA256

                                                385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                SHA512

                                                34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                28d4235aa2e6d782751f980ceb6e5021

                                                SHA1

                                                f5d82d56acd642b9fc4b963f684fd6b78f25a140

                                                SHA256

                                                8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

                                                SHA512

                                                dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                944B

                                                MD5

                                                5f0ddc7f3691c81ee14d17b419ba220d

                                                SHA1

                                                f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                SHA256

                                                a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                SHA512

                                                2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                Filesize

                                                238B

                                                MD5

                                                ed6db08f41a815ece49e35bbb6fd3350

                                                SHA1

                                                42479c6da3cbb9bde120df5a56687854ffc9f5ff

                                                SHA256

                                                33df00c804d2d8287352ebbc71c10260c72da22282266fb62ffdc18ccf604cbb

                                                SHA512

                                                296c2c968b66424a22de26b5fe2251d58a48ba43e20f9781a07ce65490991a92fe4fe8b448638fbe5e0b9cebc711e60f5e12440beb91eb17e29046a6d5e276d1

                                              • C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat

                                                Filesize

                                                199B

                                                MD5

                                                86e677723ae10a4773ab5d3b8a7bd0e4

                                                SHA1

                                                22237401765c3a4f6fa0e1081eb7e2bb7e0934e0

                                                SHA256

                                                9f133e864bd6108c89ecd77cb3114d446ade44f798df349862418f459a085300

                                                SHA512

                                                114b2b185b9c022dd657c41cb723315a885e5e66e54881a43e2ee3a676a2266b1513fd8539a5d0b6212fb0bc87125ded2cdd67e83df07caf78e041575413e8cc

                                              • C:\Users\Admin\AppData\Local\Temp\CzxnpQr0Sp.bat

                                                Filesize

                                                199B

                                                MD5

                                                52ce3d32eb8c3e8a34cddbca291e7c30

                                                SHA1

                                                72927fa7469254ae9d7d7705e47a6ee6430d48e2

                                                SHA256

                                                726d14ffdb9518c44290a124d8a6ffb9482b32fe46041700b655ff58712711bb

                                                SHA512

                                                83ef165c1ffc8f546cc2b0a49ad457c78cadeb359deeb36689edad3fdce51b0995edc98812c62ebd35520a9be2e38c019837b1c5071001da134a9f37e7af931f

                                              • C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat

                                                Filesize

                                                199B

                                                MD5

                                                b0fb759f1ffd42f338a5ef7f23e05d40

                                                SHA1

                                                09ab485cb595bdc5b91160808954b015d4731475

                                                SHA256

                                                f15162ee6d4d7466e1b37e11879ae72ec75b478f572641d9f917c86cf88e2bf0

                                                SHA512

                                                81192e3bd2a45e3dca6b854051775603d29c874e23e7b19509436fbc0bc0caefc058ecafab09b911a2bb06d30916aa2042b5b9a4da39201b15c75e06b3bc3240

                                              • C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat

                                                Filesize

                                                199B

                                                MD5

                                                f3bb1a4e95bb057b6aa66a46c0599584

                                                SHA1

                                                e3034a5a4224334288ea790d0447704b6167b9d9

                                                SHA256

                                                39efcce16adf47ca4807cbfef0cd2c953e6e0621a3767b7b6fd1454d888e16a3

                                                SHA512

                                                38f97a7a7904c65fd2aeb109fbb1611ef2696d6c6319f0f6fdcfb53144aba38044fa8a56a5ec0522db7aef8a8fbcfc833ab6c27a8ed72f95e04723ef3e1ad44b

                                              • C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat

                                                Filesize

                                                199B

                                                MD5

                                                e2cd7384da27df898b76c4d7dbe59cd8

                                                SHA1

                                                e52199d9256482637f9e81fe00b084ee8719a5ad

                                                SHA256

                                                1f675bdbcad780f5ecd98a824f9b42cec81a54b8c3eb394f94711bf5986676cf

                                                SHA512

                                                f626a6e3d02f953174808cf49a0943910dbdfe500a983d21546d60e404ef01570c2cf7c35fb89f3a719658dbf6eda84fb26029f7702dc0d9baa79958774a3bc1

                                              • C:\Users\Admin\AppData\Local\Temp\Ww6iFNwlpp.bat

                                                Filesize

                                                199B

                                                MD5

                                                9d33d93eca47baee1532dc58f159dd4e

                                                SHA1

                                                b2c1ab4538ca1b7827da2c965a7b7891cd1f1c2f

                                                SHA256

                                                56f2fc6e49aba237922bb0717b1f67c3d6197debf596fd66d445882c178fadfc

                                                SHA512

                                                f58e8983286663e85ea8c46f0cd0d796f4b10b72a3450b81707885b7fc416f8ea038d36df1d8fefe0d3c8ce5d40bc117dcb73e35057ac0439aaa7e0002b04366

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rabqpned.vxm.ps1

                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              • C:\Users\Admin\AppData\Local\Temp\aoAocY3YSO.bat

                                                Filesize

                                                199B

                                                MD5

                                                868273531e53aeb85793a0c6e747ffe6

                                                SHA1

                                                3df35746594cf6968119e1ac0ded56321914b033

                                                SHA256

                                                7ba50d21451417b3ab002293631f396f937e625e99af5455e553c55cffedf4f8

                                                SHA512

                                                919cbcfd4ef9fde6166fc8922682bf5b38b64c1fe3482820288b5fb00df0f6a31d00a7f7b6cf2da140f341d4637a807ed2eb8102b52efec16026b96e73267077

                                              • C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat

                                                Filesize

                                                199B

                                                MD5

                                                e75946b5afea96a7b35c2ca0e9a77580

                                                SHA1

                                                f3e7b19a8a2ca21b2a93f2a7596c848d211fc1c5

                                                SHA256

                                                79c3df4ce5aa6962cd8f068247029224234408444f8cfda7e79daaf1586740c5

                                                SHA512

                                                9864f81c80de99bccfa029d5852c3d0e5d9b2a394838c1fc5593e6d65d15375edd43e3312c342dd0cfb2c831b12c9f25a3f86accd5dbd8597905d7ef90833ffc

                                              • C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

                                                Filesize

                                                199B

                                                MD5

                                                46fc72f1af6baf8d7e68d2c9a68e9396

                                                SHA1

                                                aa6846e9c6535b427ce7c34c228455ec8f456e50

                                                SHA256

                                                b94f53d2085cb01b6fb499a4667e3c14cfe708439b88ea821d48d36a44a5530d

                                                SHA512

                                                570734226b194dc599cf1bf34ba2815bf19fd5b49440552c5ac9d24675bebf8db614c6e16ba7917b956cb1d1c7ce01cf2eca4b3bbc893d14086ea4d3546fb16e

                                              • C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

                                                Filesize

                                                199B

                                                MD5

                                                3c78569a3fefff9b3195ee09bc25838a

                                                SHA1

                                                d68505cbbf3bc3c064ce38edccd4cb24a29555a4

                                                SHA256

                                                663cf17ee144ce7cb410a63a237f1ccd15a27b13275c072cc8775fe01fab97ee

                                                SHA512

                                                3cd1e3072fcf17537a4de3a689725df7d6cf468606a2a223d98b18eaea9b11b9885401878ca3dff3a404cf324505accfbdf7d13d1b798e563206fa145e9d4e88

                                              • C:\Users\Admin\AppData\Local\Temp\mQXsfud8LV.bat

                                                Filesize

                                                199B

                                                MD5

                                                aed47f1e8e26dbcb65b034885f0961b3

                                                SHA1

                                                1a3f54538deb4e145f6872a099ecb963d5e07eea

                                                SHA256

                                                fe9e7ce5776f5e3e8e6dd66043bcfc1a8252dd4c8f3470ce6ad839a88f5f4ea9

                                                SHA512

                                                1d227ae7c38e9f256763d994decc341dd5fae1b930339a23ad76b0a2679c80c23c4bddc1c2deacb237fd5680e50a35daa1e8b75357228fb5a8734ee2528b3572

                                              • C:\Users\Admin\AppData\Local\Temp\pgCyA6Uc1O.bat

                                                Filesize

                                                199B

                                                MD5

                                                f90e633d2526b653126bd01811273c59

                                                SHA1

                                                9476d18023c77e5bfd86821f710d5d6b22102bd0

                                                SHA256

                                                07576f1446946534d8fed85b6bd734ca9ce7235377bd91d3c7f71e660b685ec7

                                                SHA512

                                                3d271e4c4e54024b4a2df0b37ccd64daca5cb458b27b72bf74144867de34d6c937a09cb282ce07f4a3f595fc16e408ce0354a5073740c1a26d622f7e33fae6ad

                                              • C:\providercommon\1zu9dW.bat

                                                Filesize

                                                36B

                                                MD5

                                                6783c3ee07c7d151ceac57f1f9c8bed7

                                                SHA1

                                                17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                SHA256

                                                8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                SHA512

                                                c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                              • C:\providercommon\DllCommonsvc.exe

                                                Filesize

                                                1.0MB

                                                MD5

                                                bd31e94b4143c4ce49c17d3af46bcad0

                                                SHA1

                                                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                SHA256

                                                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                SHA512

                                                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                              • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                Filesize

                                                197B

                                                MD5

                                                8088241160261560a02c84025d107592

                                                SHA1

                                                083121f7027557570994c9fc211df61730455bb5

                                                SHA256

                                                2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                SHA512

                                                20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                              • memory/1412-64-0x000001F8FF200000-0x000001F8FF222000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/2852-17-0x0000000002CE0000-0x0000000002CEC000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2852-16-0x0000000002C80000-0x0000000002C8C000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2852-15-0x0000000002CF0000-0x0000000002CFC000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2852-14-0x0000000001370000-0x0000000001382000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/2852-13-0x0000000000AA0000-0x0000000000BB0000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2852-12-0x00007FF9E2373000-0x00007FF9E2375000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/2980-270-0x0000000001870000-0x0000000001882000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/3748-309-0x0000000000EA0000-0x0000000000EB2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/5360-289-0x00000000010C0000-0x00000000010D2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/5636-248-0x00000000009C0000-0x00000000009D2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/5696-302-0x000000001B800000-0x000000001B812000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/6032-257-0x00000000009E0000-0x00000000009F2000-memory.dmp

                                                Filesize

                                                72KB