Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 02:02

General

  • Target

    JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe

  • Size

    1.3MB

  • MD5

    9d6a6c835223becab287987d7c1aae59

  • SHA1

    f2428e81d4d2a67fb5de23ca65a45254a0e6acc8

  • SHA256

    30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367

  • SHA512

    bfc8861b5b4cdc2facca5b0564bd7a07ed827b6b0d1584c31036e59254d48b51bc6d9ed21183895f902d77e7bb5e57692ba645ed6d95cea67709e6e0722fd1ff

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 10 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30cb004eae1bdb1d9613d1586c363bef8d1c4f3fc926812d2de2ec6325707367.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2168
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1576
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1780
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2652
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2664
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2600
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2656
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2516
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2536
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2760
          • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
            "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1296
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat"
              6⤵
                PID:2984
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  7⤵
                    PID:2656
                  • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                    "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:748
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat"
                      8⤵
                        PID:2976
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          9⤵
                            PID:2568
                          • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                            "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                            9⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1684
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat"
                              10⤵
                                PID:2408
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  11⤵
                                    PID:884
                                  • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                    "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                    11⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2300
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat"
                                      12⤵
                                        PID:2136
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          13⤵
                                            PID:892
                                          • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                            "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                            13⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2180
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
                                              14⤵
                                                PID:2724
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  15⤵
                                                    PID:748
                                                  • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                                    "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                                    15⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2808
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat"
                                                      16⤵
                                                        PID:596
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          17⤵
                                                            PID:2424
                                                          • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                                            "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                                            17⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2408
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BHs9KC1JDp.bat"
                                                              18⤵
                                                                PID:1420
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  19⤵
                                                                    PID:2308
                                                                  • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                                                    "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                                                    19⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2132
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"
                                                                      20⤵
                                                                        PID:1576
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          21⤵
                                                                            PID:1028
                                                                          • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                                                            "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                                                            21⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2036
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat"
                                                                              22⤵
                                                                                PID:2140
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  23⤵
                                                                                    PID:688
                                                                                  • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                                                                    "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                                                                    23⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1508
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oVhzrLBDaJ.bat"
                                                                                      24⤵
                                                                                        PID:492
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          25⤵
                                                                                            PID:1700
                                                                                          • C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe
                                                                                            "C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe"
                                                                                            25⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1088
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2960
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2964
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2988
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\services.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2756
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ModemLogs\services.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2752
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\services.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2836
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\SendTo\conhost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2944
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1492
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1724
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1656
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1728
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1916
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2016
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:772
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:532
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1416
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1272
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1456
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2492
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1944
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2908
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3052
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1736
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2904
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2236
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2548
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:444
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:832
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1784
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:952
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:616
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2472
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1240
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dwm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:688
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:572
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1360
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:308
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1036
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:752
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2396
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2288
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1928
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2464
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1748
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Temp\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2444
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1164
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1804
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2300

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  3bf27b693bc495f87aa502db0f114f9a

                                                  SHA1

                                                  a84261d70440fc25bc78bf014d47da287cfa836d

                                                  SHA256

                                                  36d464d57baba45a5dde583294eb208da52e6574867a993b03ca7d322875f556

                                                  SHA512

                                                  99d4e07ff4267b9f920ad86c3785e24a1060f91ebb43e2c6d47b7475adcd3d3dc8fd17ec2e7019b5c15ee04ff5e5ff563d644951871f062dcd5dae3b4f0a3b3a

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  c6bcbdd038fab7b19ccb0e133544acb8

                                                  SHA1

                                                  0503f3bc6b682746900fc2c757ecdb42c74adfff

                                                  SHA256

                                                  7ebc19843d1da6396c52cf12ae9c8293360e656d49a4f59dab40cb16f07d62f1

                                                  SHA512

                                                  2645ceb36aa66a294342fc77fa0e879d32ea155a3b362a0a18eb66c3655673ac22e5b041a41a73a2cf6f8f04984a2129f9bd4b661d4444f671b08c322c2c7955

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  bc7184fa5b3ba80879c8e36d80ef360e

                                                  SHA1

                                                  49477cfc8e8e5fedaa522b70167a02812cc33b92

                                                  SHA256

                                                  4f69506514b32a4c4ddea5b04786f205feb0cb6f342730ac891ca4317dd63a3d

                                                  SHA512

                                                  21d42b6f5e857ca06f643f4374c08b09ab66b555158a94e9df387756bfb5ec1a76b31483202166dc73fe5d685ea898b76b3d1cfe4309a2b608a7dbb97d3adb2a

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  6c28b8eede55f1161b55b3d5eb1192ce

                                                  SHA1

                                                  3e74c15b4d09b81e15b79467b86f63c419be4782

                                                  SHA256

                                                  8776923479fb54874baa93bdf918568fe2ee52264e577862e5ac05a5b8e93082

                                                  SHA512

                                                  9cf258f521dd5c93f7f2c2df98e674e32f41a078b483809265f99f926abd3bdd170a88e5203639d0dfe86855a3ccb31ff55248791e8aad5adc70a5d56ffe6bfa

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  7c36ddcd5d60e48ea0193ce6a4ffd538

                                                  SHA1

                                                  2851905709ad053ba6c29a2d4326d3061faa4674

                                                  SHA256

                                                  75db8285034c40abb0486d1a4b3ef6ca0233481babf0ddd227864edf9db3bec5

                                                  SHA512

                                                  5867efdd2d5103bed2a045f48e68c6c688932c451fd21edeecde891034f6208e8ce2663dad1cf96fa5b064d2535390b52dff29daf18e8ea2ce0b6ab036f8fcaa

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  4bfc5a19d970a5362be1e0219139f61c

                                                  SHA1

                                                  4cfd397b1a80833bf9ca834e40bdd29b4ad8e6b2

                                                  SHA256

                                                  82a34f23236d354a183a049af472cfaba4209629e728124f9d295a74520f5c11

                                                  SHA512

                                                  c125a30cadf475dcbdb0e570b11c0543fb79a70689ad89ce69b0106e56617f8d378ff77213f91d07865244845128bc400abbabcea18babce82a0cb8a838e05be

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  817593b22111014c5f6bdb7dce14af73

                                                  SHA1

                                                  ddda4265a6f38a1b0a58a82dc39ddbf6ba259ac8

                                                  SHA256

                                                  cbf878b92eb1460aa3ff53037692ade947516255b219ff79c576d468bca9fac7

                                                  SHA512

                                                  5b83f87046db1da16da580048c22817fff48171b1a8bac0624ed17ffeb76dc3f8c5c36e2f4de516339be64bab827b0395dcc76e6a4a54ec1220697b860b8d91d

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  962ae112a3206407973f8d076ffdb7c6

                                                  SHA1

                                                  db930cebf553dda3c9d18021b80ca406717ff75a

                                                  SHA256

                                                  3c9f8108ca82196ef6659ed9349d0da60b1fe370d8b057a30daa4249539b5e6b

                                                  SHA512

                                                  191d238a874343ff2f1499f0dbe4b87ae44e49a3bcdaba8ee63e4e382875a4e25bf08766e35eb1d838395a4b4695664eb3e0bcdbd3d23741650088bbb265ca92

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  342B

                                                  MD5

                                                  1d14ae8a97d0a0114e108fc43c33233f

                                                  SHA1

                                                  cc1450ccd6261cbaf4ea065b733cd3ec879b7119

                                                  SHA256

                                                  465ca07c627afba2211a236daa6d2724847d3079d505bccb3e6f3384c901370b

                                                  SHA512

                                                  e2bdc858b3719c7bbaee0aa88aebbe69eeae689a1c88109285654c7023b510568c273a71a1e07487166f2c31c7a8aa673d3e04be1a147ca5e93d9ccb1e3685be

                                                • C:\Users\Admin\AppData\Local\Temp\BHs9KC1JDp.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  4ca25500c09d76b3e3e1a1574551035f

                                                  SHA1

                                                  d513a24d23acd2d60d3d5c95cd7f20c479e311f3

                                                  SHA256

                                                  51c81e1eed2003390c20d4d9d275e3f1c5c2b1fa0679688bde60082ffadcf984

                                                  SHA512

                                                  42ee4093816417b559d2de2bbc3dae04ccda403996d0bfebbb17cde515a32854fadab8bfa2a47a39f370dcb0a7019a02773848a654547f97d933b2a8d1309d36

                                                • C:\Users\Admin\AppData\Local\Temp\Cab2FBA.tmp

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  49aebf8cbd62d92ac215b2923fb1b9f5

                                                  SHA1

                                                  1723be06719828dda65ad804298d0431f6aff976

                                                  SHA256

                                                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                  SHA512

                                                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                • C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  63d5ba87e857be5cb1f4aabf484caa66

                                                  SHA1

                                                  862da81b67e7c049cb3fb9152c7fddb4facfda3a

                                                  SHA256

                                                  8520dd41e7f4a6bcbe41bb2c8fd7813a0563ba9ffb915e187129b5e4bf27c80a

                                                  SHA512

                                                  872e72e01604c154d759dcd7e4109f325a3c2598c99fe6dd9cda5f334f8cef7a87628334905cf4575df9b6d1c95e2e1193531856903f6328ed437acdf0b8c4f9

                                                • C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  2f6368914735ac4e468d31640ffca103

                                                  SHA1

                                                  3770efd6153ed8a4b4e672f80594268d537785d2

                                                  SHA256

                                                  a40094ff669244a90495e12d358e7b8822195044f9b9b3a2f4bed9753d7fee39

                                                  SHA512

                                                  25fb3c9daef5c22f8e596468b3bbe0284b4f01f205a45134a8d6ac48a89f8324b3ac5e7422994b6c71eb679f595f4de5b4ba07ab19aaff6df1696606399462f0

                                                • C:\Users\Admin\AppData\Local\Temp\Tar2FCC.tmp

                                                  Filesize

                                                  181KB

                                                  MD5

                                                  4ea6026cf93ec6338144661bf1202cd1

                                                  SHA1

                                                  a1dec9044f750ad887935a01430bf49322fbdcb7

                                                  SHA256

                                                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                  SHA512

                                                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                • C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  f918a0085a54baed2263a79a5e44e469

                                                  SHA1

                                                  e0612edb944d5ea8b2a0b2b7406dadf5028bdb17

                                                  SHA256

                                                  9113cc92e831dd71a6622d5002146b9e5a4e89007ec3924ef5c48eff4626c98e

                                                  SHA512

                                                  c55d76dd44c9ba2c3b62372c4800cee77477f6a6ff08132723f9f7bf83b418bef66e0051c527d7a60e5ba39ed457c037bb8e56f038dc6b8cd83a44b0f18dfa58

                                                • C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  e7fe49cb58e9e6e34b2a09ef76257e4a

                                                  SHA1

                                                  d766c811547ce4750fb30541efc0b9eff42c8e53

                                                  SHA256

                                                  dc76da6caf28a2d0934e45c873f3aaca32f099308b3214258ccb548c0487cad4

                                                  SHA512

                                                  3a48aaa4b0d66564a196a8617e5eff7056dbb3f73d292d1caaecce75b2a74318a37476d4ece9ea852a2a419460ec1594edb4db67f724ef1ba890c7ddcbeae180

                                                • C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  aa7b4dc54561fe897fba4b4b171e1c16

                                                  SHA1

                                                  51aac1ea8aa13d597258ec88ccfb381a1ac98eca

                                                  SHA256

                                                  e4d4a0a7c6ae70170a4785b605577e207105d82b59c716193f94a6c7434bb4ca

                                                  SHA512

                                                  bb17d7664d4a4703d93894e29c0f3ea93d552d3807961af34f5699820618a49e8cf17fa29f225b7781dc92ae1dcc6ade840fc831a0c4f34d00b0fd987f4f5a8d

                                                • C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  dc8ab9a1338358154f1726061386f06c

                                                  SHA1

                                                  4633af7ffb6fb74f1f595fb5745b0a7b06c95887

                                                  SHA256

                                                  80eac3aa295241287bbe43830558041a634412008da67f2d7f6cc71b2858da5c

                                                  SHA512

                                                  68bb6c11b1642a6375b9f285fa79221b4065ef8d4052b8d45e837c0ee822d8681f59cb61ce3bb6bdaf35296715f7c7e42fdb24f69df82adcc0cea4de589f17ce

                                                • C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  08d2fb6362e1342e39e0026e41f9a3b5

                                                  SHA1

                                                  a426e88a3b3077ee18242b9ab511784cec5ef838

                                                  SHA256

                                                  dce7c8ae1e3caf432b221b2f3dade39cb312894e031eac9d516ec042fff6d36e

                                                  SHA512

                                                  ab09761b3a3079ba7bcc27d07bd0933b3bc9823f9a1a54cf1af5abc08752b0183ed799171ce1c7ba6bf78ff760c28d70ab0f07f6b6d946759b59167b22f68230

                                                • C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  1ad7ebd2c20b45643fe6c7543f2a46d7

                                                  SHA1

                                                  a150cf2ee12316cb484619405846390115b46cc1

                                                  SHA256

                                                  f75d2e870b36da612854b99f3b13fc4c942ccccb12c2ec959d2463d9fd750025

                                                  SHA512

                                                  8d91c3acc0f157d94f3e9529c01030cdba90233471fa7366150fed76477909224fba6bc39286f37474dd847ed841718d807cd4798324c7509b1fe985a34057f0

                                                • C:\Users\Admin\AppData\Local\Temp\oVhzrLBDaJ.bat

                                                  Filesize

                                                  221B

                                                  MD5

                                                  39eeba7789fd25a63eb267c459351514

                                                  SHA1

                                                  d543308b797f213239250fe52e8fe18c31fa9783

                                                  SHA256

                                                  1f1f8dc70f1d35bb2a391d37ea9a3fd62d189b82ed53f448e6c008b18df04a32

                                                  SHA512

                                                  a776c6c549838d34f3c04779fac322b3e6ed57e98319c10924d05d32eed6a72d0ac1b565b8f5fc0f7b060bfeea5ccb721e8208a544f686adfb1c57769dfc9347

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7XZNCWO1JT30FY3GKVDL.temp

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  fcc14d48e0ccd1e206ab22f7c95b9a38

                                                  SHA1

                                                  013fd5bfcf8870c9ba2b9a71ec809602ccb51f4b

                                                  SHA256

                                                  1285d385dc44c229195b761b428c239fef3de8c0a38c2b8dd261bef224b16474

                                                  SHA512

                                                  5e770a15aa31338c49f5e3616b7f17e65315c1d0979d3b491dc62809be3d8e6cd33852b2ea8f889e55d3799cb7870450f75ac4b1be3c8c8cb0b15685cc210b66

                                                • C:\providercommon\1zu9dW.bat

                                                  Filesize

                                                  36B

                                                  MD5

                                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                                  SHA1

                                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                  SHA256

                                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                  SHA512

                                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                  Filesize

                                                  197B

                                                  MD5

                                                  8088241160261560a02c84025d107592

                                                  SHA1

                                                  083121f7027557570994c9fc211df61730455bb5

                                                  SHA256

                                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                  SHA512

                                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                • \providercommon\DllCommonsvc.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • memory/748-189-0x00000000013C0000-0x00000000014D0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1088-730-0x00000000002E0000-0x00000000002F2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/1296-65-0x00000000002B0000-0x00000000003C0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1508-670-0x0000000000240000-0x0000000000252000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/1508-669-0x0000000000EE0000-0x0000000000FF0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2036-609-0x0000000000370000-0x0000000000480000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2132-549-0x0000000000300000-0x0000000000410000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2180-368-0x00000000002D0000-0x00000000002E2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2180-367-0x0000000000390000-0x00000000004A0000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2408-489-0x0000000000130000-0x0000000000240000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2544-17-0x0000000000570000-0x000000000057C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/2544-16-0x0000000000550000-0x000000000055C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/2544-15-0x0000000000560000-0x000000000056C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/2544-14-0x0000000000540000-0x0000000000552000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2544-13-0x0000000001170000-0x0000000001280000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2760-62-0x0000000002230000-0x0000000002238000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/2760-61-0x000000001B650000-0x000000001B932000-memory.dmp

                                                  Filesize

                                                  2.9MB

                                                • memory/2808-429-0x0000000000250000-0x0000000000262000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2808-428-0x00000000002E0000-0x00000000003F0000-memory.dmp

                                                  Filesize

                                                  1.1MB