Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 18:43

General

  • Target

    JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe

  • Size

    1.3MB

  • MD5

    1dd05197d833b7a1ed48f6346c08312d

  • SHA1

    deca10ce5d8849d9b5f37aef5d6a36571497605b

  • SHA256

    6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b

  • SHA512

    cc20be7ab836dc9868282a7e0f40e73d304e6b20e0025d27fae5ea49044f5f1eb58cebecccc7e68d85d849cd696ae04ede89cde51f188d159cf14f5e7ad89134

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a2253ac9c22fa4e3c1408f86814e49eaf05115398c7d3ca8a5e5f0a96a0bb6b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\mui\0407\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2828
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1228
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2140
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2424
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2916
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2584
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2500
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xaOsFiDaJy.bat"
            5⤵
              PID:2488
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                6⤵
                  PID:680
                • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2464
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
                    7⤵
                      PID:1896
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        8⤵
                          PID:1540
                        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                          "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2176
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
                            9⤵
                              PID:2724
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                10⤵
                                  PID:2288
                                • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                  10⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2704
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KwQfKFARzT.bat"
                                    11⤵
                                      PID:2204
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        12⤵
                                          PID:2128
                                        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                          "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                          12⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2284
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
                                            13⤵
                                              PID:2756
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                14⤵
                                                  PID:2604
                                                • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                                  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                                  14⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2648
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"
                                                    15⤵
                                                      PID:3048
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        16⤵
                                                          PID:2384
                                                        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                                          "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                                          16⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1128
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wKGJ2NUoAL.bat"
                                                            17⤵
                                                              PID:372
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                18⤵
                                                                  PID:2816
                                                                • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                                                  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                                                  18⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3008
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"
                                                                    19⤵
                                                                      PID:1892
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        20⤵
                                                                          PID:680
                                                                        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                                                          "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                                                          20⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:300
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat"
                                                                            21⤵
                                                                              PID:2836
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                22⤵
                                                                                  PID:1952
                                                                                • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                                                                  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                                                                  22⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2792
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
                                                                                    23⤵
                                                                                      PID:748
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        24⤵
                                                                                          PID:1092
                                                                                        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe
                                                                                          "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe"
                                                                                          24⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2424
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat"
                                                                                            25⤵
                                                                                              PID:1584
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                26⤵
                                                                                                  PID:2628
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2700
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2736
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2644
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\mui\0407\spoolsv.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2832
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Help\mui\0407\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2652
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\mui\0407\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2580
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2456
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2432
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2496
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2564
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2912
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\fr-FR\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2920
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1824
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1036
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Recorded TV\Sample Media\wininit.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1800
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\UnattendGC\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2272
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2292
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\UnattendGC\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2296
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1792
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:796
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:808
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2284
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:624
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1416
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1536
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1636
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2732
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2940
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2336
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2156
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1640
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1868
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2372
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:804
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:764
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:304
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\services.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3064
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1788
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:532
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1076
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3060
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:836
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:564
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2404
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3032
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1752
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2344
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:684
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1504
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2204
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1940
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1032
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1720
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1288

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                3a0bb6897ea856d0c79e179126cf34d9

                                                SHA1

                                                957d87f77b3fa682dee842440398b215a8881893

                                                SHA256

                                                6989ccd3679628e66968bdc48e51e3ccb5ef319026863452664aeb39ea9f0573

                                                SHA512

                                                0ba2a6d52e2b11dd1d7fb57b196cee05deb068c1ed1a84f6b4a538d7c8b5b4e1fb60dee5a1bdcfde3746783cb20854e915ee982c0183d213b258fe08f3dc3342

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                c1b51c2964bd0185a7ab700b7b844e9b

                                                SHA1

                                                f35fbb9541aa18351ffac85996c565958cdc2142

                                                SHA256

                                                68c46fb0f9ee276b7eb71ddee32db77f8c93b59a597e09b8d21b8dbca16aa1a8

                                                SHA512

                                                a8a9c4b69e9195f5044e9cc11bb4cdb42bd004a7e0c94353f8043dc59890f97b4f030c0d3bcd6d9dae1707544acbaabe621005e5f16d00b8b48ff0966e675d94

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                d1d70e6ac892f247b0ef55a77908af44

                                                SHA1

                                                b570cab441dfd308aedd86126677b2a88bec70c3

                                                SHA256

                                                019159220b67cf3c1fa366e048b97b7fc7568232a1b66747911bb8a499887d1d

                                                SHA512

                                                1a22a59b89a3adb91a2ce2c29d88e84600493a5d12cd153e0076506c432d407208ee6bc01a0e31672268b3003fac5edef14cc1b222953eebb737584ad2cf3218

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                e517c0633e332b9379f846b1646a285a

                                                SHA1

                                                261fb24b8548739d917497aaf5a6afc00bd36894

                                                SHA256

                                                d449a11795ba1ec5c2bb132b67d9eac6ae35a04abd3b9e30b3c421962f94e190

                                                SHA512

                                                32c1b90e031588d6332a05c4e6018b07c658dad7c3113896ead5cdca9d5bd630c5866f91ce91a9fb9005720050867bdcb9cb64501924674d45d3853427dada7f

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                84638630d2c265f1d70227523f6be358

                                                SHA1

                                                94e61fe3723dc3f2d03790434851986ef3278a48

                                                SHA256

                                                85155b398703e023d6bf93c694f2ee0029352bacf8a1181d6bcfb54e5f51e6e9

                                                SHA512

                                                f4ecf182974a8178511da5c1e50d97c31e4ec43e1443092c44209041e7f04aab89c64825ed094d9cfeda8106b4658fc7d0fec2c5e084a22c4cc78608ee791613

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                4fb8c2e5b3d935ca90e44ed97cf85a59

                                                SHA1

                                                f1470893412d80219fcb4164f87f04243e971b8c

                                                SHA256

                                                eb18d9a234f80c9ceba834130975f31cc649ebc651e35730084fbdf805f86933

                                                SHA512

                                                e06aa356da7cf384d9fe1a6754bad7768cb2e54ee470c4a2c21f1bdfdde29e3f8c1dee639d86347326090b14e1741e2063d952bd0d554091e59847b55d6579dd

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                27d1059a1c9251ccb3860bb8ac884ae7

                                                SHA1

                                                93903acb57edc7731472e6687c5c2e51b10c2162

                                                SHA256

                                                4b051a4d592f214ef15606eb79d25f4be5e67595c183ddf4599acabc79e6fcff

                                                SHA512

                                                cf9193e5fbf9789f9808ef788a56e86f0dd5714e1ced38fa5dd027b0f7dd83a7644f7964a216e86ca09334f9ebf190dd5268433bbbd46a68a695d11d2b4181ac

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                6e3113b7c34a03ac273a9dcc8680948b

                                                SHA1

                                                f9b4f403ac0d99d07392747cf839272a9f7c222b

                                                SHA256

                                                4342d1759f55b44f431f872f214a7f1b15367caff8b077b408272114530385ba

                                                SHA512

                                                d370799681bd2e9503079f828d44eb340ae9898ec2307c9422b968509b8feda9a14ba3ff663ee138b849e30d20b0216e3d02af9cc370b4d8b56853ae7f115f04

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                30b2f13bdcb61273ba05acf75dda281f

                                                SHA1

                                                c5343f9ab9285cabbc73dba49fbe443c3bb7198d

                                                SHA256

                                                d0da8726412f4cacc39f9df8b455a26346cbd48425acbefd68a83b3a9ba34aae

                                                SHA512

                                                ebe860e4ed957ab040e59b864bc54705a1dbc1948a7994c33a6a42fa12e88b154bad8c3d051c347dc81306f929668ed0a54695598c88d938ebdaabce9a9ac0d6

                                              • C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

                                                Filesize

                                                248B

                                                MD5

                                                7009f77322a8b2e25169c521a96de318

                                                SHA1

                                                6c637ce401c56fc44c03e8f9f896204bed592d1d

                                                SHA256

                                                5e219420eb24a5fa40137a0cb3b876ef205d2460cfc3996b3e8719023828f37e

                                                SHA512

                                                733ff4f3d0ae891659cee93e4c0d72f6a0a613d19baa0171fbd667f755797d08f15063e851d82fe35a641bf9326abdc292394942f0daa41ab5d955e9632326f4

                                              • C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat

                                                Filesize

                                                248B

                                                MD5

                                                1348404f6cd6dcdb4590501697c6a51e

                                                SHA1

                                                c805279ecc26f8292c897e99b66357f70a203997

                                                SHA256

                                                51a675e7be9e303914f5015299d8a7cd5d02f98a3be8f6631aa99c88705b73e6

                                                SHA512

                                                b412899c7fc4e65f5882d6f13ee6ffe5df92e00773a7bc22b4f247a82a358375e25e810583df05189fa7123941dcd6235d8c18d470f98e33d75a6e2c651f625f

                                              • C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat

                                                Filesize

                                                248B

                                                MD5

                                                d849cf584b89e957ac0c8568d841c9f3

                                                SHA1

                                                f408cbfc2d4abef8c44310ff98ee8b4ca9b053a8

                                                SHA256

                                                c2247c58680d3d970d411a1ae3f74b6b5a99bf6b62c24f2c4f90252e2598eb3e

                                                SHA512

                                                4f9a8b542bf811e0e4b27144b36b45410b7dfcb65851a3b9632189758262572955fea934b4e7912fc9b3fb9d11af5c956544a6e51ee2d1ef7789cd4351fadd74

                                              • C:\Users\Admin\AppData\Local\Temp\CabC6BB.tmp

                                                Filesize

                                                70KB

                                                MD5

                                                49aebf8cbd62d92ac215b2923fb1b9f5

                                                SHA1

                                                1723be06719828dda65ad804298d0431f6aff976

                                                SHA256

                                                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                SHA512

                                                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                              • C:\Users\Admin\AppData\Local\Temp\KwQfKFARzT.bat

                                                Filesize

                                                248B

                                                MD5

                                                6db874d9166e0d515ba0df5fe418bd96

                                                SHA1

                                                eec03e744412c5db46c038e9cb6c54c91eb16dea

                                                SHA256

                                                195f6504ac3acef4a9a7108e69231f91c4a4d60b5933cadfcefa51ce1ba66744

                                                SHA512

                                                a955025718a0c66fdebf079e04982fadf53db26b1dc5ff316180f44af810a63878e6f7983e0d62241a21d32a886bfa4e12716eec44363686565be0a2ce82a42e

                                              • C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat

                                                Filesize

                                                248B

                                                MD5

                                                b5f38ab836d148d304f31d294590127c

                                                SHA1

                                                0e98cd0f860bf1c6d98dae03c65eca1dc9059a47

                                                SHA256

                                                d603a8e640761c0f215e253a57273f133f1737a7255f5b88f9dbe1bc82acbfca

                                                SHA512

                                                802a8dbd72e7dd5394e176a33a71a6c07857ce4a02aa9d87476045dd45257147f108abc8727ca1f5d01f2c352ce3fe1cc8e9db57fbfbba1140d3deb1adb386d8

                                              • C:\Users\Admin\AppData\Local\Temp\TarC6CD.tmp

                                                Filesize

                                                181KB

                                                MD5

                                                4ea6026cf93ec6338144661bf1202cd1

                                                SHA1

                                                a1dec9044f750ad887935a01430bf49322fbdcb7

                                                SHA256

                                                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                SHA512

                                                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                              • C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat

                                                Filesize

                                                248B

                                                MD5

                                                0d79dc29ff84f31d8d0cb4e5b64437f7

                                                SHA1

                                                9f1536301e6047214e0668d32e71ea013603cc7c

                                                SHA256

                                                41cc05434f52e1c9fcac6ce18f19b11177fbe6330f2433450d9695cc9439b64e

                                                SHA512

                                                b28da6c5081fcff51360de0182ca90f5ae8900e44ffd303babf27a7587902ce7baf7ce732031658a2fa0d4220f727687366e1d268e9af375ab6257aaa629fb76

                                              • C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

                                                Filesize

                                                248B

                                                MD5

                                                655fd45cf831594327f8a28a46a4fda1

                                                SHA1

                                                13a41c92d9f77a60ac9801d78067b8a474a34802

                                                SHA256

                                                629df46ff10b873a756ae8689aee48e1a3d320309ee267dd68a0216177613732

                                                SHA512

                                                9be0765e12d4d99066e53aec8b1dbdac8a65e65d92022c5903b352d1314a04218ec85b122089df67dc93f25a5276cc8b127c1e024eeb8c615580257fc0d9cf40

                                              • C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat

                                                Filesize

                                                248B

                                                MD5

                                                12fc76e685f4e8ea00b1ca8211413fc1

                                                SHA1

                                                fb0e082796fd681fdeb1348b5d07165c3fe8adbf

                                                SHA256

                                                7ab1e86aeae01dbc4036ad45cd321c67ba13087771df14471adc9a7d1a91111a

                                                SHA512

                                                701c50a2676fca988dc893998684c999467b50ff1bd4a9cc40faabb69adb0b164d76376cfadb8d390b318024c9455b48d35dd045e92c3c25f736767df5f8e4aa

                                              • C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

                                                Filesize

                                                248B

                                                MD5

                                                3e1a05238438f63294140deb59e91c90

                                                SHA1

                                                d3b95c82528d52e9ea68689dc0b65f3f9b5c5d33

                                                SHA256

                                                b6645c70e90e836bc09d9da88e5dac315ecfd76d65470ea6a25e7f4e3270e3cb

                                                SHA512

                                                bb1e003c111be962c3b9af631efd64a63f082e9deb1918f5ecec680ce2c1ce4eb5189d1c84713e7a4e373d6c48d5b7f23065e724d7c09a31e3ba55580a6aaf09

                                              • C:\Users\Admin\AppData\Local\Temp\wKGJ2NUoAL.bat

                                                Filesize

                                                248B

                                                MD5

                                                0ce3c069dd96419d3cbf48ee80060e3a

                                                SHA1

                                                6b01e6a18955bab5d6de1217424698808f2dfd6f

                                                SHA256

                                                56493aea1b0b29f5e8a186cf6ede30472c6fd4329ae2abe495c7077b7cb5422d

                                                SHA512

                                                aba99e2b38183e1a56758f062742db78eda8be4ed1843c8fc96ca76b81bb3685a52c3f7182972b09f6bd83c88e71d890c971ee364e72255dc8ba6e59b0a3b3c5

                                              • C:\Users\Admin\AppData\Local\Temp\xaOsFiDaJy.bat

                                                Filesize

                                                248B

                                                MD5

                                                45f8aa5b2dfbcce24e3f47defdac529e

                                                SHA1

                                                c784ed02f045409aa4e172210be75a43171d9981

                                                SHA256

                                                ffb3fb6add4c88625624c780115ab56db1c0ebf5c70926aaf31fa82c6156d729

                                                SHA512

                                                aee021da42ffd930615e03b33ac2124493db9f0a3d1f18e91a6c8b935e831592f9dace7e4e0ec47acc32c1c70823f032cd0a583b85de7212a4a023d9e6a5856c

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XW8TM1HNGJ7BDEJ2GELT.temp

                                                Filesize

                                                7KB

                                                MD5

                                                bd10607f4a014b1f591273f8fc8a4392

                                                SHA1

                                                3ff60012d06c443769eab585a99527ee800f1006

                                                SHA256

                                                281a2c75383ff9894540311430c57c4e0b60b4ebf770c8d844eefc8889f0e7e0

                                                SHA512

                                                6f908e03ff6b70bc131bbc3aa13d4748bee8d02f17688302a34b46c1cdc18eeefbf885191c48200ae0af3fe01ae94ef3cc42f3f27eae9c1bca8cf8e41b0bca33

                                              • C:\providercommon\1zu9dW.bat

                                                Filesize

                                                36B

                                                MD5

                                                6783c3ee07c7d151ceac57f1f9c8bed7

                                                SHA1

                                                17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                SHA256

                                                8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                SHA512

                                                c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                              • C:\providercommon\DllCommonsvc.exe

                                                Filesize

                                                1.0MB

                                                MD5

                                                bd31e94b4143c4ce49c17d3af46bcad0

                                                SHA1

                                                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                SHA256

                                                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                SHA512

                                                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                              • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                Filesize

                                                197B

                                                MD5

                                                8088241160261560a02c84025d107592

                                                SHA1

                                                083121f7027557570994c9fc211df61730455bb5

                                                SHA256

                                                2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                SHA512

                                                20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                              • memory/300-567-0x00000000012E0000-0x00000000013F0000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/300-568-0x00000000004B0000-0x00000000004C2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/2124-73-0x0000000002320000-0x0000000002328000-memory.dmp

                                                Filesize

                                                32KB

                                              • memory/2176-211-0x0000000000E60000-0x0000000000F70000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2284-330-0x0000000001020000-0x0000000001130000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2464-151-0x0000000000900000-0x0000000000A10000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2464-152-0x00000000004B0000-0x00000000004C2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/2584-72-0x000000001B610000-0x000000001B8F2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/2792-628-0x00000000004D0000-0x00000000004E2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/2944-17-0x0000000000270000-0x000000000027C000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2944-14-0x0000000000150000-0x0000000000162000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/2944-13-0x0000000000160000-0x0000000000270000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2944-15-0x0000000000290000-0x000000000029C000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2944-16-0x00000000002A0000-0x00000000002AC000-memory.dmp

                                                Filesize

                                                48KB