Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 10:45

General

  • Target

    JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe

  • Size

    1.3MB

  • MD5

    0e82b7d081049f607d2fc1587c6e1cec

  • SHA1

    c9e5549f53779ee98675a58177f18d1a5fe95d71

  • SHA256

    9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1

  • SHA512

    ee233f1476d06a5832bd2fca32fd79a63bbde9d8c2d2343934c6dd90f27a9078cc432f19ac19b33d21af8110678da85203b8a0860672ff2f242104583dd9b22c

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 10 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2260
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1856
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2512
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1756
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2364
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\System\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:856
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1308
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1584
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2372
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2404
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Help\de-DE\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2380
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1108
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2684
          • C:\Program Files\Windows Defender\de-DE\audiodg.exe
            "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1256
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
              6⤵
                PID:2720
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  7⤵
                    PID:1624
                  • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                    "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1824
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
                      8⤵
                        PID:1536
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          9⤵
                            PID:2788
                          • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                            "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                            9⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2052
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat"
                              10⤵
                                PID:2776
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  11⤵
                                    PID:1916
                                  • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                    "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                    11⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2376
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat"
                                      12⤵
                                        PID:2280
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          13⤵
                                            PID:2716
                                          • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                            "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                            13⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3056
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat"
                                              14⤵
                                                PID:3060
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  15⤵
                                                    PID:1708
                                                  • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                                    "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                                    15⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1720
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
                                                      16⤵
                                                        PID:1804
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          17⤵
                                                            PID:1596
                                                          • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                                            "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                                            17⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:568
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat"
                                                              18⤵
                                                                PID:1308
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  19⤵
                                                                    PID:2456
                                                                  • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                                                    "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                                                    19⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2716
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7FnFm4j3ls.bat"
                                                                      20⤵
                                                                        PID:3024
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          21⤵
                                                                            PID:1132
                                                                          • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                                                            "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                                                            21⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2360
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat"
                                                                              22⤵
                                                                                PID:1836
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  23⤵
                                                                                    PID:584
                                                                                  • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                                                                    "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                                                                    23⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1072
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EUl4QLAvAv.bat"
                                                                                      24⤵
                                                                                        PID:2080
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          25⤵
                                                                                            PID:1960
                                                                                          • C:\Program Files\Windows Defender\de-DE\audiodg.exe
                                                                                            "C:\Program Files\Windows Defender\de-DE\audiodg.exe"
                                                                                            25⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2100
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2616
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2216
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2872
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2604
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2624
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3060
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Speech\lsass.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3064
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Speech\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:524
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:780
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\System\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1368
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2460
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2968
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2580
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1516
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2680
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\de-DE\audiodg.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1744
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\audiodg.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1548
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\de-DE\audiodg.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2136
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1868
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1428
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2276
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2184
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2020
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1668
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\sppsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1496
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\it-IT\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1040
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1836
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1076
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1060
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3012
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1136
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1600
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:372
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Help\de-DE\audiodg.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1876
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Help\Help\de-DE\audiodg.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:772
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\Help\Help\de-DE\audiodg.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1532
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2448
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2024
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:756
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\providercommon\audiodg.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2328
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1540
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1696
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1724
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:556
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:852
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2672
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2412
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2160

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            88393777e34ab0b3628461a46f81bca3

                                            SHA1

                                            86ac8180a373b75ee314f23f4ffc8409a3f57fb8

                                            SHA256

                                            db9e36f3c4a5e6b11d7802456cbcb6cb01276edd9b0a8425c3741a348e9d48cf

                                            SHA512

                                            80d5e1843fda7b8afefbb4c9dfaf0cba64e9db05bdc61d4387fda74719edfec9277db93791289b904751cbc4c0132bbe67a2eb9306e626d347ffcf7ab377f80c

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            c4ce04e77546640cd6a9ec0072018450

                                            SHA1

                                            739084819a29bea10b8c3d0a6f4acfe59cc6a6b8

                                            SHA256

                                            44ba6b5965c48ca5b0f2909262940ead913333d8bac9d596db26055143bdb285

                                            SHA512

                                            85bd7a4c1019566b4803f893413fedb26bd00718448e23896ab92e4b67714a50102aeb2dbc36df47bed63779b009b556ce795298ff035ee0765a7c0ace5c2d1b

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            cb63915740ea3566fad60cef57f4e0dc

                                            SHA1

                                            c64fbefc99b9566add8b3e9a9edf1738398c351f

                                            SHA256

                                            2b17321b76f4f198454e1aa625ec382c418b052e004949bae4fea9e71443597f

                                            SHA512

                                            1297eff58198434ad0a5e8914941b73ac4cb74e8ff81d4aabb38f2e9a71904f922a9fa9c9af9ded9c80cfca14ab0026e163f51561a8e5282ce76c39b8e9bccee

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            705aaf1d8d7402cfcb6facd0d0a7155e

                                            SHA1

                                            1c4f5f6e538b6c2bd80e0d4d9430cb3e8ec51e9d

                                            SHA256

                                            a5b00556e1ea69afc17524338f1e4288662ab777f5f262d092b1c346a1458799

                                            SHA512

                                            973d100fa545f85a4aaea5690bbce78d45ee5cb4d75be43444ba07b7a6a930a6380c908164053c4614beac6f4ad679564d81130ea3b6a66b8cafdce4eb784df8

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            e7378d581c83bb958bc50f669912cf44

                                            SHA1

                                            4fc0f8821b46389e4fb5dac5d45aaa88e15b9834

                                            SHA256

                                            98a405f43f6ed1bbad6af6b3d905fbebb916242d02be2f0c744cfc3baad9b21d

                                            SHA512

                                            72b2645a0d925f97197823631edb61ca9003bd415ab33dcaaa7b3be8d929f09bde5c95a612b891a2f4947bc37c9d6e1c131cbc9653f9a4b26f6ce015978738fc

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            07994a1afdc7c33459c81ee43e972d3a

                                            SHA1

                                            2f13332d3e95d1e10b91f713529c57a35f57812e

                                            SHA256

                                            78710b7411e0501ad4abefec5267736ec994487b4b6debc5b11461809344a6e6

                                            SHA512

                                            c7a3429ff2e7b5a36f2dff0ec572812d6f85cff42cf32109579b7585f202824e441c5aff33b22604f046c0b563d129fb4908a0c22be13f13f77db40bcedcca3d

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            1057d157cd61490f08b0cb56936577d7

                                            SHA1

                                            fe436aabfabdb8c82c376e25266d8699c1d8b5d8

                                            SHA256

                                            10eb6308d02cc627b30817ca1c7eb1df9b1ae6dbc2c80b99ea237a5ed9bf4ac1

                                            SHA512

                                            5627484d67fca12fd01ebbdf7004ed75948ad8a018cc1237f5e984d8e043b728e66e61bcfd09ae18699ecc88e9adb9d52aa2b25f3790ae1b2175f1db086969a9

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            4197db331c64a9f6ea43449b0d3f0bfa

                                            SHA1

                                            ab45c62010850c4c36c5fc0520e64849a56067ae

                                            SHA256

                                            8d39609aac8888fbf9b991af59139f63d6cfb6ac570c497f052e7a3d4f43a28e

                                            SHA512

                                            8f6d2af244acbf0a511c3be42f0d08200402a10d92cfb35b3f233e82f0a6781621e34fa81114172792ff57f2cb109e5a88f0e7a49b0bd4173baf23c491c2d375

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            469c6bd5c737e5b1e8fc093ed9fd47a4

                                            SHA1

                                            3ee48ee12cfe484c60d103fabddc38ecae89a33a

                                            SHA256

                                            e311af551d4f3ba7917dc1bd3eeb72e02e704dcdd1b6de5cec6687492ac9e012

                                            SHA512

                                            cbfc95e4025ff660c393a46872dccb28a0fc769a339b7da2be34aa48a44d53d5325f6ad2c9c2cd7e69565d672e0c7d7bba996fee98154180118a7b69b7b9efd7

                                          • C:\Users\Admin\AppData\Local\Temp\7FnFm4j3ls.bat

                                            Filesize

                                            216B

                                            MD5

                                            eabca5af02a0b0eecde65025e4651878

                                            SHA1

                                            e5eb4aea1aab9a1980e23f019615903a16ae2432

                                            SHA256

                                            acc71f9edf6101de46cfe25fb139e55046908f9c242de4d5924f775fe8c83f93

                                            SHA512

                                            c95a467e855a95d0bc1d90dd6af304fbf3d160ff0513c3f799c05573ce06f8636f584e8ffba0eb3ab095ee8b817187c669fc2140aca8f7b2efa367ef2e63183c

                                          • C:\Users\Admin\AppData\Local\Temp\CabCFCF.tmp

                                            Filesize

                                            70KB

                                            MD5

                                            49aebf8cbd62d92ac215b2923fb1b9f5

                                            SHA1

                                            1723be06719828dda65ad804298d0431f6aff976

                                            SHA256

                                            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                            SHA512

                                            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                          • C:\Users\Admin\AppData\Local\Temp\EUl4QLAvAv.bat

                                            Filesize

                                            216B

                                            MD5

                                            6af168a8c7084c3f1aa54088e85383e4

                                            SHA1

                                            d858f505c437591151b73bb76245ce821205323c

                                            SHA256

                                            e373253b0f770d92d44461cd9e7502a43e6d874dbe16c1562a4377850ed1ddab

                                            SHA512

                                            66e466351be5a28db6039e2fd66709ae59a546b0cbac7be1284f1c49c7aa09e3a7e7473fa299f63ab02142cce66b4b352e0867764ff020a6e49f23d4c8771cb2

                                          • C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

                                            Filesize

                                            216B

                                            MD5

                                            c8c15e6c1c7f647bd9b8866021422a59

                                            SHA1

                                            be160e339ff82081cdec0ec838362402b2262d81

                                            SHA256

                                            f8a74401d4f10193a405712359ab28f6577170d61abeab77fde0eb3c371a1b02

                                            SHA512

                                            2b4bc163c68f4e52b5bdd9d21239673e525c560b703d95f38447800f2f2658646db3dd1afa444de5186e629959de5ff69709441de14d8cbae9df83c31c2b1ccb

                                          • C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat

                                            Filesize

                                            216B

                                            MD5

                                            46f229d0f376016f7b1d601f043d490b

                                            SHA1

                                            1bd75359365f9f644d3a14c03f723d65dff822b1

                                            SHA256

                                            e9775ed5953947094f023c7f8d81914589f9537bd472ba2bb1d2c2ad50361c30

                                            SHA512

                                            1533cbe128bafa89e442b077df8002ec79ce507e48d6e9402b6b3abbc913ed258338ebfeb93007aa9f7a5b02245d0aa7b6b1212bdad81b2af5d119125e3b3e23

                                          • C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat

                                            Filesize

                                            216B

                                            MD5

                                            81f08d4aae5766bee219c524b3c1cdf1

                                            SHA1

                                            9d1af76e16ae251eca8f8c5c2ca47a7b80306791

                                            SHA256

                                            f1936a84fb00758e424aeaa536d02d2d4391a985a48c303334d8ef4e7555254f

                                            SHA512

                                            758837c1fc1a20db26e5d90cd4f6208f2023ef443d77df7f7c3071edb60974ff1556d409fa25d87e7c26cf7a75cf74a0fe838f2d645d756dcf7cf48c2fbfab3e

                                          • C:\Users\Admin\AppData\Local\Temp\TarD020.tmp

                                            Filesize

                                            181KB

                                            MD5

                                            4ea6026cf93ec6338144661bf1202cd1

                                            SHA1

                                            a1dec9044f750ad887935a01430bf49322fbdcb7

                                            SHA256

                                            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                            SHA512

                                            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                          • C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat

                                            Filesize

                                            216B

                                            MD5

                                            6ae87e0a08674b0d0474055d85d2bd16

                                            SHA1

                                            5f6b06ce698e0c3f68aa0c50b726c6f3f7f89992

                                            SHA256

                                            fcf2f61a70d4ece9a45a6ed49677f6c7a362c34383ec66d3cc71c65854b52030

                                            SHA512

                                            2d36b85d4a89a73a0480f91cafaf2452219e93f0eca35eeddf3ab2a8f2eb33b2c75e72a6ff79a6fdbf840cf9fc89934e4f6a6eec9319ee22e79d9d93e78ed009

                                          • C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat

                                            Filesize

                                            216B

                                            MD5

                                            1e93f18f97d74b7a1e02a570a0e00a54

                                            SHA1

                                            ae97368824a4c6710327dbb3526aea223785507e

                                            SHA256

                                            1e05a9362220bd601f12936404e475cb6adf00f91b1bc66462677b1d4460e137

                                            SHA512

                                            f41b964616bc440a86d94feb27e762e00ba38710ef6935f20b09fd13305c618c6d4c81f49900cb4f1c89e01861eda1fb3fe18cd5c675c34bd0cd7323b9522c3f

                                          • C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

                                            Filesize

                                            216B

                                            MD5

                                            5621b127bc013021190856fe172ecd7b

                                            SHA1

                                            68c859334858c0797d1f0af9da3cad30d75d77e7

                                            SHA256

                                            265b85ef0957d8d3e56c19e0919da80f968e65b502a3c91aee3e663914f02792

                                            SHA512

                                            888d30b3f689978ea5fd943468f48677321c8119081d355398aa5a8b19db4665e1a0c827642a71fec9a8295ce8c6fccdf6fb3a35ceb8581523038aae06f486bd

                                          • C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat

                                            Filesize

                                            216B

                                            MD5

                                            38279e8460f7c9c819974afa0ef1078e

                                            SHA1

                                            6d70b3399ce1f29862c79118dda96ebe7056499d

                                            SHA256

                                            a4e18a2047d2d2baa9298c097d421534b91f7d898091d110578fb0b31d36c85c

                                            SHA512

                                            9a75d6d096fb10d69ba443febea8f983f20ccde1617ff21d92be708cf68b0e640624b91ffcfafae478094651b99a3811b79721a6abd81607bada72f171c47448

                                          • C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

                                            Filesize

                                            216B

                                            MD5

                                            7b29cf0d9177755b129a513cfbc4f995

                                            SHA1

                                            39aaadc7cfce667154c90c1a60f67ce68d489354

                                            SHA256

                                            c43ecf40a599c7603469d49f7484bcbbc2a01c343abda4dace8113c97520f8f0

                                            SHA512

                                            e4ce1c537e9156ac1d7f0d2edaf8a86e183203019a0c476febc5060cab5e7df64f372bb7906002a30ef45da3297c196bc8bba74ccd1cfc3510167cbd64e36375

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                            Filesize

                                            7KB

                                            MD5

                                            6282f65ff876c73c0c5cef8d33f50917

                                            SHA1

                                            f42ef8969f9cfb75060a837d30df480378edc5f7

                                            SHA256

                                            4b5a6811f9647f301baedcbc4090917e8415ca0b4e35272ba2db912f6ac43b8e

                                            SHA512

                                            e2b23617caf0a01fd19d9b7a27ec90cd66b56d437d510ff6f599676aef57cf95d730247ee41697675932ad6f2c421dbe3d1514ef2233060b56018d7325aece89

                                          • C:\providercommon\1zu9dW.bat

                                            Filesize

                                            36B

                                            MD5

                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                            SHA1

                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                            SHA256

                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                            SHA512

                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                            Filesize

                                            197B

                                            MD5

                                            8088241160261560a02c84025d107592

                                            SHA1

                                            083121f7027557570994c9fc211df61730455bb5

                                            SHA256

                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                            SHA512

                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                          • \providercommon\DllCommonsvc.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • memory/568-500-0x0000000000140000-0x0000000000250000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/840-14-0x00000000003E0000-0x00000000003F2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/840-17-0x0000000000610000-0x000000000061C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/840-16-0x00000000003F0000-0x00000000003FC000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/840-13-0x0000000000250000-0x0000000000360000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/840-15-0x0000000000400000-0x000000000040C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1072-679-0x0000000000300000-0x0000000000410000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/1256-71-0x00000000010D0000-0x00000000011E0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/1688-73-0x0000000001E80000-0x0000000001E88000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/2052-261-0x00000000013E0000-0x00000000014F0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2100-739-0x0000000000D30000-0x0000000000E40000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2376-321-0x0000000000330000-0x0000000000440000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2512-68-0x000000001B830000-0x000000001BB12000-memory.dmp

                                            Filesize

                                            2.9MB

                                          • memory/2716-560-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/3056-381-0x00000000013A0000-0x00000000014B0000-memory.dmp

                                            Filesize

                                            1.1MB