Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 12:11

General

  • Target

    JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe

  • Size

    1.3MB

  • MD5

    5fbc4bca617169252bda8262e9b737a9

  • SHA1

    ac83bf7260fbe3716603d46f70aec1fbc86683f2

  • SHA256

    346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af

  • SHA512

    95f7674512882251acef53907c1c6b0bf68da43ef2e4ab28053328b85bb8f5d4608963826d852b0ac19fce2689761731364545415830ec657b36cba088eba62c

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_346b17c3b64930e9ec6509fd38bdb30c24c4e04761a57e9fd0eefe13addce0af.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4000
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3960
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4468
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3508
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3192
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5048
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4560
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4516
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2232
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4956
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2960
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:628
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:5072
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4180
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3972
          • C:\providercommon\DllCommonsvc.exe
            "C:\providercommon\DllCommonsvc.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5948
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\csrss.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:5960
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"
                7⤵
                  PID:5652
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:5320
                    • C:\providercommon\powershell.exe
                      "C:\providercommon\powershell.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3340
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat"
                        9⤵
                          PID:3396
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            10⤵
                              PID:4420
                            • C:\providercommon\powershell.exe
                              "C:\providercommon\powershell.exe"
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3080
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat"
                                11⤵
                                  PID:2616
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    12⤵
                                      PID:5612
                                    • C:\providercommon\powershell.exe
                                      "C:\providercommon\powershell.exe"
                                      12⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2960
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat"
                                        13⤵
                                          PID:5372
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            14⤵
                                              PID:3312
                                            • C:\providercommon\powershell.exe
                                              "C:\providercommon\powershell.exe"
                                              14⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3604
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Oj9OucH8K.bat"
                                                15⤵
                                                  PID:4664
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    16⤵
                                                      PID:5724
                                                    • C:\providercommon\powershell.exe
                                                      "C:\providercommon\powershell.exe"
                                                      16⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1624
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
                                                        17⤵
                                                          PID:1848
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            18⤵
                                                              PID:4984
                                                            • C:\providercommon\powershell.exe
                                                              "C:\providercommon\powershell.exe"
                                                              18⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5152
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat"
                                                                19⤵
                                                                  PID:1612
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    20⤵
                                                                      PID:6100
                                                                    • C:\providercommon\powershell.exe
                                                                      "C:\providercommon\powershell.exe"
                                                                      20⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4000
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat"
                                                                        21⤵
                                                                          PID:5256
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            22⤵
                                                                              PID:5960
                                                                            • C:\providercommon\powershell.exe
                                                                              "C:\providercommon\powershell.exe"
                                                                              22⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1440
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat"
                                                                                23⤵
                                                                                  PID:1488
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    24⤵
                                                                                      PID:6024
                                                                                    • C:\providercommon\powershell.exe
                                                                                      "C:\providercommon\powershell.exe"
                                                                                      24⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3708
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"
                                                                                        25⤵
                                                                                          PID:5392
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            26⤵
                                                                                              PID:1152
                                                                                            • C:\providercommon\powershell.exe
                                                                                              "C:\providercommon\powershell.exe"
                                                                                              26⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3508
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat"
                                                                                                27⤵
                                                                                                  PID:3560
                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                    28⤵
                                                                                                      PID:5636
                                                                                                    • C:\providercommon\powershell.exe
                                                                                                      "C:\providercommon\powershell.exe"
                                                                                                      28⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4980
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4JlC5zfAS6.bat"
                                                                                                        29⤵
                                                                                                          PID:3100
                                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                            30⤵
                                                                                                              PID:1596
                                                                                                            • C:\providercommon\powershell.exe
                                                                                                              "C:\providercommon\powershell.exe"
                                                                                                              30⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4328
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat"
                                                                                                                31⤵
                                                                                                                  PID:4760
                                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                    32⤵
                                                                                                                      PID:4280
                                                                • C:\providercommon\powershell.exe
                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\OfficeClickToRun.exe'
                                                                  6⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5972
                                                                • C:\providercommon\powershell.exe
                                                                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\powershell.exe'
                                                                  6⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5984
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat"
                                                                  6⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3452
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    7⤵
                                                                      PID:5204
                                                                    • C:\providercommon\powershell.exe
                                                                      "C:\providercommon\powershell.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6008
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\unsecapp.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3868
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\uk-UA\unsecapp.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2696
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\unsecapp.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4952
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4804
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1516
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\DllCommonsvc.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2868
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:920
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1324
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\dllhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3880
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\conhost.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2928
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\conhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3396
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\conhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1148
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3528
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5036
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3860
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\spoolsv.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3824
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\7-Zip\spoolsv.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3856
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\spoolsv.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2412
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4580
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4896
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2976
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\System.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1536
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\System.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1916
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\System.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2620
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2236
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3116
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3044
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2212
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4920
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\System.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1452
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4104
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2576
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Favorites\Links\RuntimeBroker.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3472
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5080
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          PID:2064
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:208
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4660
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3696
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3900
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Panther\UnattendGC\lsass.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:876
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\lsass.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1076
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\UnattendGC\lsass.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3632
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1568
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4528
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\fonts\SearchApp.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4276
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4036
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3496
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1980
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\GameBarPresenceWriter\smss.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:740
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\smss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          PID:3452
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\smss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3288
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2616
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4568
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2224
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3700
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1436
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2040
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\csrss.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5428
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5460
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5552
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5644
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5708
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5772
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\providercommon\powershell.exe'" /f
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5844
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5868
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
                                                          1⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5912

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          7f3c0ae41f0d9ae10a8985a2c327b8fb

                                                          SHA1

                                                          d58622bf6b5071beacf3b35bb505bde2000983e3

                                                          SHA256

                                                          519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                                          SHA512

                                                          8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                          SHA1

                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                          SHA256

                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                          SHA512

                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          2979eabc783eaca50de7be23dd4eafcf

                                                          SHA1

                                                          d709ce5f3a06b7958a67e20870bfd95b83cad2ea

                                                          SHA256

                                                          006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

                                                          SHA512

                                                          92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          62623d22bd9e037191765d5083ce16a3

                                                          SHA1

                                                          4a07da6872672f715a4780513d95ed8ddeefd259

                                                          SHA256

                                                          95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                          SHA512

                                                          9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          cadef9abd087803c630df65264a6c81c

                                                          SHA1

                                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                          SHA256

                                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                          SHA512

                                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          59d97011e091004eaffb9816aa0b9abd

                                                          SHA1

                                                          1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                          SHA256

                                                          18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                          SHA512

                                                          d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          28d4235aa2e6d782751f980ceb6e5021

                                                          SHA1

                                                          f5d82d56acd642b9fc4b963f684fd6b78f25a140

                                                          SHA256

                                                          8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

                                                          SHA512

                                                          dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          5f0ddc7f3691c81ee14d17b419ba220d

                                                          SHA1

                                                          f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                          SHA256

                                                          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                          SHA512

                                                          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          e448fe0d240184c6597a31d3be2ced58

                                                          SHA1

                                                          372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                                                          SHA256

                                                          c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                                                          SHA512

                                                          0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          e243a38635ff9a06c87c2a61a2200656

                                                          SHA1

                                                          ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                          SHA256

                                                          af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                          SHA512

                                                          4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          e8ce785f8ccc6d202d56fefc59764945

                                                          SHA1

                                                          ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                                          SHA256

                                                          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                                          SHA512

                                                          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          a8e8360d573a4ff072dcc6f09d992c88

                                                          SHA1

                                                          3446774433ceaf0b400073914facab11b98b6807

                                                          SHA256

                                                          bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                                                          SHA512

                                                          4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          aaaac7c68d2b7997ed502c26fd9f65c2

                                                          SHA1

                                                          7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                                          SHA256

                                                          8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                                          SHA512

                                                          c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                                        • C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          4d5b4cd795371b6bdcd372224271cea3

                                                          SHA1

                                                          a3626b9546b7e92cb1894cb25fce98eae32fc5df

                                                          SHA256

                                                          5cc1010eb320fc7f0c90f9c37ad5b4d13a5169ebe3e25b246c6d230749ad4bbc

                                                          SHA512

                                                          8a02044d08bc2e00a229c0d89a2d2a1393abec827c6bb1bbf2d5dcef123504c4de2ccdb238e2e4dfb8648a57fa2032492d5eb40f1c4c1b709e046695ff58c6b0

                                                        • C:\Users\Admin\AppData\Local\Temp\2Oj9OucH8K.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          45a4b7ae268db352cf6f6b8d76d85b85

                                                          SHA1

                                                          d9f898f16690e7dddb3d1e3f455dc203fbf982f5

                                                          SHA256

                                                          ceaa538bcf48f01670355a1a3eeac6eaceeac769b2fc774c37ca47b088a56d88

                                                          SHA512

                                                          4f453db026ade4978a8adfc0da632d384c552fed11863300e058bd16eda3172ff6e71cc3170061bb28e259f77b6e9e9852752b416de27e38039cf00683c8615f

                                                        • C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          a86873bce88151f3f3c562f8bf87a799

                                                          SHA1

                                                          9072f7e354eca77f55fd9480e206fc9dcbac4702

                                                          SHA256

                                                          4546755011e85cc301d0c29c87a9092fa9e59e8711fd88d65e1d7eb2125188d3

                                                          SHA512

                                                          e6b86459430a9331d5c207771ced63e52698067bc618b0893eeed8ac65259e2c69ac1c50808ec097b26bfc97e50b50fd3f8dfb38ada9caa2b34cbff83b684ace

                                                        • C:\Users\Admin\AppData\Local\Temp\4JlC5zfAS6.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          fc43896afa7db145253423374e926b07

                                                          SHA1

                                                          667ba7aa41974b00a3da170362f93aeb84c573ec

                                                          SHA256

                                                          0ef6302cd5374fbaf1038eef22ef8239bb565055c1bd24ad51af6fb9514d79ba

                                                          SHA512

                                                          ca279a7b0f291ad567ecbe270af0730deb1ce7560842a2f5bd8cdebadc9cd420e1334f84434e1c4ac1880c5b7fa8c1bfdb78b84658889b7a4fd64a17abc41e5c

                                                        • C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          3cdb82f268620848e6a70b102ead8abc

                                                          SHA1

                                                          3a8556fa6d07e53f6ffa05adeba497d1e7bf160f

                                                          SHA256

                                                          26d9fd42ec0aa354cceaa5a7a411e8a7a908c81e8f86ff4521eac5fc66c7360e

                                                          SHA512

                                                          38138df9ce630436da32ccafab1ef27e94aff7aabe638a342b901ec39292d7e2b87852f925fbfe5c1956009cfcd00c3e40928ced321bd942f2226ca183b372b2

                                                        • C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          aafd5e6bede527ac9e1c9a3b1e083315

                                                          SHA1

                                                          886aafb626a1a457b35c9f6e30e2a425cd7acf19

                                                          SHA256

                                                          bad9165a7a8e8cbc62830fe4b650e13e4b9be115f970e9807cf3d371b0aec118

                                                          SHA512

                                                          d9a79c1e51dcc654eb867760b0bb9c26675f6848e889d2b423398ec37f0c55a68b2a3f8b3b1edcfca64faa53f615a420078abefbf819f7125eefa66d18cf533b

                                                        • C:\Users\Admin\AppData\Local\Temp\PN219sj1of.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          0812e51c7f3fe400641f4e7e5bc215fa

                                                          SHA1

                                                          c06fb74bc3841b05cf91f3e102c2a0732c518633

                                                          SHA256

                                                          b09084acc58b9a3ab4a81cab073cf31d6a2f8c7caf247dadfc49948eff77ca41

                                                          SHA512

                                                          91b6b8b6aa5d2dbe96bfa425721d43ef6e686f368c34138a4d5732fcd4e3eef11366295ed54088d58affd39a44533c5c6e53295cff39227057e7a3e8eca80489

                                                        • C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          12cc914aede1789a00062ea8d7f937a9

                                                          SHA1

                                                          0721e33200e6075af3076021fd426f7087f8c4c2

                                                          SHA256

                                                          5c5ea8ea7f62dc58ec6a7d1dc0154943ea7b9c1139e24cc2684ac0901b01f6b3

                                                          SHA512

                                                          a3031bf006d9dda3cc3c43ccfbf6258b4808beb378fa91397d11329560ec47f18765d87067a8d31454c8b2b1a104ca6d3caec439b2418e710956b1e5f81c25a2

                                                        • C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          abf6b1590571c3ad0bf600d3303126f6

                                                          SHA1

                                                          17eab73b6109edbac529ddb66e6d06f0deaab83f

                                                          SHA256

                                                          78e8963d6a0d278d1a4a7609b05d0fe703977167de52c8cd34d801f0fe909390

                                                          SHA512

                                                          b44b7b96df84b9703cf7a091095f5524ba33fd59a213310426c1b1674d94cfcebdc6802f594eec0c9018b7dcb9549c6dc23f85a986ed804b11a1e904fa844e61

                                                        • C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          d4f1835a2e412acc9cf74c8a0de6738d

                                                          SHA1

                                                          be3d5c55633a6a1d9c433c46162a9b4caa4cc847

                                                          SHA256

                                                          4e5ceb713b4867e49d219ab6296c2dc4ee6a4f46acecba8da967ceb5b246f250

                                                          SHA512

                                                          56d234ca12d62bff7f28631c4074373d3d0f138206e395baa7d3b15b98d4d0151246d803066e3f824f2f200d81a4534402cbb971cab48042297b92cca7029b68

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ydjjcz12.5ia.ps1

                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          9456d2199fd368c627e49c6fa8136a9e

                                                          SHA1

                                                          09fdd5a013e65a2b92317ee5edf7ec0b6b9232be

                                                          SHA256

                                                          f462d8751cf95b3a76008d1940320930fcdc27f70c4d5d69f8c751fd90f878fa

                                                          SHA512

                                                          089eb45dc36c24ccb1a406ee739a4735c54b3d0ffb36966e84cc3f54fcb228b6cba2721e8cc8d116f5d605a6bb57c17577a08a4a221915c0546e64e215870941

                                                        • C:\Users\Admin\AppData\Local\Temp\fdSjcfTSOA.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          a5fbcf79ec7ce252723e4978fe89abd4

                                                          SHA1

                                                          5cd62a2b48eab220479a3ba9b196d1bfa272321a

                                                          SHA256

                                                          a17c38e14498eddd3318abb7eb0e354b8b8f714ce000bd445a4355307e3485af

                                                          SHA512

                                                          1c721330ba9b63d420a9e0468be3313a9506ddab1b8b542390c301142fe712ea70596584f064d6ee021c2f47f285e9a33b120c861489908e2a785cef8045cc72

                                                        • C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          73211da06fc8e1f9bc72fa6e3eb59311

                                                          SHA1

                                                          710215d8aaefcb57b2529f91bd6b4fb45ccc44a7

                                                          SHA256

                                                          7afc06ed97cf0ff9d017a70cd72fa26227fb979e2832e21129dbe7b1c65fb34f

                                                          SHA512

                                                          b8c8ffed440335fb7cf93f012d864af40ffd16cf3c8a5a7fd270760de9e597c185d12152fac33660595fc39c4039091979a1c857ed0c4a49e8387f8eea3c8d12

                                                        • C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat

                                                          Filesize

                                                          197B

                                                          MD5

                                                          c5cab2db0be641ba455ba954866df490

                                                          SHA1

                                                          a20b94ac205afd253a8bd8212cac15abffaf1e50

                                                          SHA256

                                                          fc19e07453fbbb63e96f9dc2fb693957d354b9e457f353d5dde7ad103a9954c2

                                                          SHA512

                                                          c13a49ac188a68763c4976d01f9aabdd3d0bd52b71155400c70a1b27df2d699caa111d734d618bddfdad201ff8c894ddba9037ec25114427e447b3a9cd78b71c

                                                        • C:\providercommon\1zu9dW.bat

                                                          Filesize

                                                          36B

                                                          MD5

                                                          6783c3ee07c7d151ceac57f1f9c8bed7

                                                          SHA1

                                                          17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                          SHA256

                                                          8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                          SHA512

                                                          c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                        • C:\providercommon\DllCommonsvc.exe

                                                          Filesize

                                                          1.0MB

                                                          MD5

                                                          bd31e94b4143c4ce49c17d3af46bcad0

                                                          SHA1

                                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                          SHA256

                                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                          SHA512

                                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                        • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                          Filesize

                                                          197B

                                                          MD5

                                                          8088241160261560a02c84025d107592

                                                          SHA1

                                                          083121f7027557570994c9fc211df61730455bb5

                                                          SHA256

                                                          2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                          SHA512

                                                          20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                        • memory/628-73-0x000002D6D3230000-0x000002D6D3252000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/1440-350-0x00000000024C0000-0x00000000024D2000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/3604-324-0x00000000014A0000-0x00000000014B2000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/4000-15-0x000000001BB40000-0x000000001BB4C000-memory.dmp

                                                          Filesize

                                                          48KB

                                                        • memory/4000-14-0x000000001B300000-0x000000001B312000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/4000-13-0x00000000006F0000-0x0000000000800000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4000-16-0x000000001B310000-0x000000001B31C000-memory.dmp

                                                          Filesize

                                                          48KB

                                                        • memory/4000-17-0x000000001BB30000-0x000000001BB3C000-memory.dmp

                                                          Filesize

                                                          48KB

                                                        • memory/4000-12-0x00007FFD0B323000-0x00007FFD0B325000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/4328-375-0x000000001B9B0000-0x000000001B9C2000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/5152-337-0x0000000002AD0000-0x0000000002AE2000-memory.dmp

                                                          Filesize

                                                          72KB