Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 09:28

General

  • Target

    JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe

  • Size

    1.3MB

  • MD5

    8241afb589889b622ac576fd8ad1f303

  • SHA1

    6fa2f421f79de1ec100516dd85142313903acaaf

  • SHA256

    d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a

  • SHA512

    7d43c9a5eaa1d3ebde9cfac789cee4f10e21f8e12bd4b13ba8284caee7bef66c97d5349e26e894caca84f50b210df329374d536a562e0a702126efabb3bbf20f

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 45 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 18 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2644
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2268
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\OfficeClickToRun.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1172
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WaaSMedicAgent.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2380
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4072
          • C:\providercommon\DllCommonsvc.exe
            "C:\providercommon\DllCommonsvc.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4688
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3676
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4620
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1612
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4356
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3412
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4384
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\conhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3908
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2792
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\Idle.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:756
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3100
            • C:\Recovery\WindowsRE\powershell.exe
              "C:\Recovery\WindowsRE\powershell.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1368
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1872
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  8⤵
                    PID:4272
                  • C:\Recovery\WindowsRE\powershell.exe
                    "C:\Recovery\WindowsRE\powershell.exe"
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    PID:4384
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2524
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        10⤵
                          PID:1928
                        • C:\Recovery\WindowsRE\powershell.exe
                          "C:\Recovery\WindowsRE\powershell.exe"
                          10⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:872
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
                            11⤵
                            • Suspicious use of WriteProcessMemory
                            PID:464
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              12⤵
                                PID:4920
                              • C:\Recovery\WindowsRE\powershell.exe
                                "C:\Recovery\WindowsRE\powershell.exe"
                                12⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2940
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L8pPJcA7Kt.bat"
                                  13⤵
                                    PID:700
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:3972
                                      • C:\Recovery\WindowsRE\powershell.exe
                                        "C:\Recovery\WindowsRE\powershell.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1652
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat"
                                          15⤵
                                            PID:3980
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              16⤵
                                                PID:1468
                                              • C:\Recovery\WindowsRE\powershell.exe
                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                16⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4424
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat"
                                                  17⤵
                                                    PID:2884
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      18⤵
                                                        PID:4696
                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                        18⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4536
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat"
                                                          19⤵
                                                            PID:3616
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              20⤵
                                                                PID:1000
                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                20⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:872
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"
                                                                  21⤵
                                                                    PID:2072
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      22⤵
                                                                        PID:5032
                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                        22⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4220
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat"
                                                                          23⤵
                                                                            PID:1620
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              24⤵
                                                                                PID:376
                                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                                24⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2740
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
                                                                                  25⤵
                                                                                    PID:1088
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      26⤵
                                                                                        PID:4836
                                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                                        26⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2992
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat"
                                                                                          27⤵
                                                                                            PID:3824
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              28⤵
                                                                                                PID:2524
                                                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                                                28⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1840
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"
                                                                                                  29⤵
                                                                                                    PID:3544
                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                      30⤵
                                                                                                        PID:1852
                                                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                                                        30⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2300
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat"
                                                                                                          31⤵
                                                                                                            PID:4936
                                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                              32⤵
                                                                                                                PID:624
                                                                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                                                                32⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1324
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat"
                                                                                                                  33⤵
                                                                                                                    PID:3788
                                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                      34⤵
                                                                                                                        PID:4468
                                                                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                                                                        34⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:1580
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\OfficeClickToRun.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3956
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4264
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3332
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2992
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1368
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1588
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1044
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4820
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3656
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:728
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4372
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4272
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:772
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4236
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1720
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:916
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4988
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4920
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3660
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2648
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3580
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2352
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2536
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1588
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1468
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4820
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3656
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2032
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4372
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2512
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\providercommon\winlogon.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2108
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4836
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1720
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\SendTo\conhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2424
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4960
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:224
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4304
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2276
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4080
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:640
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4936
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4048
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4816
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:680
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3452

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      7f3c0ae41f0d9ae10a8985a2c327b8fb

                                                      SHA1

                                                      d58622bf6b5071beacf3b35bb505bde2000983e3

                                                      SHA256

                                                      519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                                      SHA512

                                                      8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      a43e653ffb5ab07940f4bdd9cc8fade4

                                                      SHA1

                                                      af43d04e3427f111b22dc891c5c7ee8a10ac4123

                                                      SHA256

                                                      c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

                                                      SHA512

                                                      62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      6d3e9c29fe44e90aae6ed30ccf799ca8

                                                      SHA1

                                                      c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                      SHA256

                                                      2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                      SHA512

                                                      60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      6c47b3f4e68eebd47e9332eebfd2dd4e

                                                      SHA1

                                                      67f0b143336d7db7b281ed3de5e877fa87261834

                                                      SHA256

                                                      8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                                      SHA512

                                                      0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      2e907f77659a6601fcc408274894da2e

                                                      SHA1

                                                      9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                      SHA256

                                                      385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                      SHA512

                                                      34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      cadef9abd087803c630df65264a6c81c

                                                      SHA1

                                                      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                      SHA256

                                                      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                      SHA512

                                                      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      9bc110200117a3752313ca2acaf8a9e1

                                                      SHA1

                                                      fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

                                                      SHA256

                                                      c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

                                                      SHA512

                                                      1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      4165c906a376e655973cef247b5128f1

                                                      SHA1

                                                      c6299b6ab8b2db841900de376e9c4d676d61131e

                                                      SHA256

                                                      fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4

                                                      SHA512

                                                      15783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      50d3033f2bc3a3774c469d03e71a79a9

                                                      SHA1

                                                      22027b1d52085de99b3bffa276530fea5d961471

                                                      SHA256

                                                      2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147

                                                      SHA512

                                                      ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      b801d886e417a9bf405b2f0092e04fe1

                                                      SHA1

                                                      fa99fefa2f49af240141692f78c8c28f04205389

                                                      SHA256

                                                      57b1c29eef54567fcfdaa28d2923485cb6f77bb76dc54235965fb34f02a42636

                                                      SHA512

                                                      b2c8bf95b4c25d7fff388b5f3e04212c43af9588f7aed8a7cb251330ee18c89789eb1d294b8449ec2afeb9b5373d7a6dce8f4369b84cbfb6a7c7813341fa07ff

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      944B

                                                      MD5

                                                      d3e8199b4634731cf0a0c26c1f14f588

                                                      SHA1

                                                      7f8fae27eb80055a436a6b5457978f32673d9ad4

                                                      SHA256

                                                      ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a

                                                      SHA512

                                                      806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2

                                                    • C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      b6fdb28dd03877ab7f3a023e109b33fa

                                                      SHA1

                                                      28628b549aeef223479ad8199ad4bfcdce975d03

                                                      SHA256

                                                      542e21b4b13734ff6cc31807e86bbdf4346be4168d23ce70d3780ee1e95af645

                                                      SHA512

                                                      2be65436a65de3e23e0e236cbb1269db1a476f6a2f4b83db3672cb99433abd825fb5a1725cd75e59e4a593cc11a9bc3e19a9d601b33d330494962330e55fff40

                                                    • C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      722e2ad3b3c8be9b49312bce765002a9

                                                      SHA1

                                                      d4610e10664ac21134cc2bae18defad2aff4c2a0

                                                      SHA256

                                                      6f73ad87465a0e377e9d51d0ffe72938f4779076c4147314f8a19f4e1b1cad89

                                                      SHA512

                                                      3c239a7c356b4b02d78e44edf51d4a75be04d1fc64d6041032bcf9a7b4640048df5ea9d4dcf6e8be32c3b9b701a74d2628619efb41469b1c3385dcd3d28df23a

                                                    • C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      4c9429927eeb21b2f5f7fa5765c6498c

                                                      SHA1

                                                      5e21f007ea5754d9f54cca37ccb2710a1c7a28f9

                                                      SHA256

                                                      26582e31ec96cab7227012be4bb71db39be7897659e92757c2c2f8f02d258ad9

                                                      SHA512

                                                      6f47a4a67678cf7520b4256cac3987ed027d552da1f16cb7a1c2c48baea4e58b9c4223f86b19a4103201f20bbcd199df23971af6eb02bfe0df3d311eecf881df

                                                    • C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      51ea86878b834cae28289f94104e4173

                                                      SHA1

                                                      5949b7571d31db84f55f0a7eb904a1a14fa6ffdf

                                                      SHA256

                                                      6cf0dd8832252bf215438f72b226ce87ed27381ef1e8769b0331cee36dbc0b31

                                                      SHA512

                                                      12fdc56d1b4584d36909887e41179eae7c07c7bb2d4468debbf7b54dc567047edf798e4b75f0fb53ab561031ad43c2762a85e585a616d9efb8824626e6fcf4e1

                                                    • C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      ae6845f48f2342a78dc435e09d574e5e

                                                      SHA1

                                                      f75b8acf1a5fc0389304a8bcfa69dffae719cf9b

                                                      SHA256

                                                      25e2ae88f81cf0d0941d348d75adbb3a075c285855f903c0eca649bd8945fb8d

                                                      SHA512

                                                      65ab4575b34c32ff25fc9b3dac8b3a45158d0b6fd558978d3d251ec4504f0e093ad8d376c6055c24320529c4cf48c4688e0c5a59e6866f679becff2e0ee200fb

                                                    • C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      7fe1a4462fd163f40faa46a7b1d414e9

                                                      SHA1

                                                      e3f811c374efda0e8c09d7f56589b9a7fb5bab67

                                                      SHA256

                                                      24957d8dd0f16f4ae7f0e614105f480eaa0fa6755be0276359feb363ff85c92e

                                                      SHA512

                                                      3561a883530fc8685bfe52970c3505224f25af724c91e962e16e0ee99376d33055da46aeeaadcaa55b2db34dc80ba6795910907f7cebf5657ba6ee80aa3d9d0b

                                                    • C:\Users\Admin\AppData\Local\Temp\L8pPJcA7Kt.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      8c41cefcf0e2dedfdaec92f0c9e3759b

                                                      SHA1

                                                      88ee148cb4b4b6926c2428e9163441a2d15e16fa

                                                      SHA256

                                                      07abb1bb3ebf6cfdd183d8bfa51883e11060ac5432e4e8ee3bdaa37074f89a27

                                                      SHA512

                                                      daf581b1e55b4ddf1f92dbe2cb221d8de2ac467c80ac64986e8cb5a97660bce188e35d8e4645aeafdc422c4a1feb745a21d8eba3a480bc3c49107b1a90a036ff

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nys1stlq.4yd.ps1

                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    • C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      9744ef65941e74368499e21c42556639

                                                      SHA1

                                                      b66ca2ab31647e7fbcb7ebbb3c1b8a13d0e64465

                                                      SHA256

                                                      2a2e0391d74e496cd9c474dacb951e27514ce8fcc963cbdc414bbbe06dff958c

                                                      SHA512

                                                      96ee3c815c01817fd9bdd3ee030d84a0dd0768966315a4d9443894cc847185f5eedc8cbd3d1c30befaeea06862db783799647e42e0835c8ab55d932af229fb10

                                                    • C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      e1fe4bbb6d51933c49c1b4039d05349a

                                                      SHA1

                                                      e6062435ef93a513ec7465ca4de3ddac1cf890ff

                                                      SHA256

                                                      071420b4e3658c1aca04ee314663c7289ad9e5c80621379e21cd52197eb1cbe6

                                                      SHA512

                                                      95ce496a28b80f53102da298e1b4112628ea8e86edafcac9a118dfe93eac197dce18efa6a588728910e62ee5a4aff755a34950dba1b18c5cd54f841342e5e06c

                                                    • C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      5da31515d6e3094084df06814ccebcb8

                                                      SHA1

                                                      d7cf8e8570d420d06daf7c8f9192a6a357b61a98

                                                      SHA256

                                                      5ae92d6207c54e769a0c540beb7695c56931e5b431b9d86d5a9c310767457a65

                                                      SHA512

                                                      1795fde3a97a7be9f56693d3b3b8dbfc379784e6c81c56d67922a4b88b92775cec02620761e86ddcf0d85ab287b844ab85fb15ce6e642132cffd1fff40a88f70

                                                    • C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      7b26cac5d2ea23eb44ac02aa16f0a742

                                                      SHA1

                                                      d6d1ddd95331120237f3511a69c07c7f2154cfa6

                                                      SHA256

                                                      f0a9a5d72026ea220cf5b7190852087a8a41871e4e964a1969499f9225619be3

                                                      SHA512

                                                      2661c614682e8be6fe4ada315f4652846ad49389b099ea9145668b1f3c78dfe88554fa0bf2945f52eca4a51d498dd18932b4a34f47c9c5dbeb278d5d4d541d77

                                                    • C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      fc333e47d4e7bf7e14709e512d6adc3b

                                                      SHA1

                                                      f608f29f012c1edd7d9f5ad06c514a0612b52045

                                                      SHA256

                                                      0d2e40fcca1a45fa0f5f518443cb233965338f83948321650eff2e3bd329fb34

                                                      SHA512

                                                      47065de7c0feab10381a8285f4fb2a867d405b88c9dc67249b6c0cc3e0febcfd5032d20108b9417d7cb2ec368197cf36cadf270659807e3c066ede8f6c0597ab

                                                    • C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat

                                                      Filesize

                                                      201B

                                                      MD5

                                                      b5d212387cce6123b8f96fcbe246662b

                                                      SHA1

                                                      aeeca7f9d5a312784f2e5b35684a90c0d6ea123e

                                                      SHA256

                                                      b4d2d6eac23b7101af4ebc69a4c5212aef9454ee5298410d127b1b9b7fafbf01

                                                      SHA512

                                                      53c2a95a72a609cc8cae9b1c1bc2280517444497881cb7cca76fd9d5fddbeebf6f7ba1225bc91587f96345799bcc1a80febaa9550e95bea80498c58eeb27bea9

                                                    • C:\providercommon\1zu9dW.bat

                                                      Filesize

                                                      36B

                                                      MD5

                                                      6783c3ee07c7d151ceac57f1f9c8bed7

                                                      SHA1

                                                      17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                      SHA256

                                                      8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                      SHA512

                                                      c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                    • C:\providercommon\DllCommonsvc.exe

                                                      Filesize

                                                      1.0MB

                                                      MD5

                                                      bd31e94b4143c4ce49c17d3af46bcad0

                                                      SHA1

                                                      f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                      SHA256

                                                      b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                      SHA512

                                                      f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                    • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                      Filesize

                                                      197B

                                                      MD5

                                                      8088241160261560a02c84025d107592

                                                      SHA1

                                                      083121f7027557570994c9fc211df61730455bb5

                                                      SHA256

                                                      2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                      SHA512

                                                      20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                    • memory/1172-41-0x0000023DB4680000-0x0000023DB46A2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1324-319-0x0000000001650000-0x0000000001662000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/1652-260-0x00000000028D0000-0x00000000028E2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/1840-306-0x0000000000AF0000-0x0000000000B02000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2644-15-0x0000000000F20000-0x0000000000F2C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2644-14-0x0000000000EF0000-0x0000000000F02000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2644-13-0x0000000000620000-0x0000000000730000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2644-12-0x00007FFE63B23000-0x00007FFE63B25000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/2644-16-0x0000000000F10000-0x0000000000F1C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2644-17-0x0000000002980000-0x000000000298C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2992-299-0x00000000012E0000-0x00000000012F2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/4220-286-0x0000000003040000-0x0000000003052000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/4536-273-0x0000000002E80000-0x0000000002E92000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/4688-97-0x0000000000FF0000-0x0000000001002000-memory.dmp

                                                      Filesize

                                                      72KB