Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 02:03

General

  • Target

    JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe

  • Size

    1.3MB

  • MD5

    2a1f4d34ad5c44906d6fec7584afb5e9

  • SHA1

    54cc1a9fe88281490bb5c3336a505a16d88e2e02

  • SHA256

    bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99

  • SHA512

    341a3dead26b8be2374d25f9cdfc28c662ffb2d76ee1ef4ac59e79df7deef11c1155216565b527d5f9aaaa2a24c8f53839ef51417c30d7c4b0d29c6df667e1f3

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcf048384781099cbf7333dba8d51985908a33cdb1dfbb315a33ff8af92c4a99.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4432
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:220
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3408
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5012
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5100
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4000
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:8
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1196
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4488
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4868
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\taskhostw.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:468
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1616
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1624
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1180
          • C:\Program Files (x86)\Windows Mail\winlogon.exe
            "C:\Program Files (x86)\Windows Mail\winlogon.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1396
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5124
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:5196
                • C:\Program Files (x86)\Windows Mail\winlogon.exe
                  "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:5280
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5464
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:5496
                      • C:\Program Files (x86)\Windows Mail\winlogon.exe
                        "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4276
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5572
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:748
                            • C:\Program Files (x86)\Windows Mail\winlogon.exe
                              "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:640
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ssDSZpddA3.bat"
                                12⤵
                                  PID:6020
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    13⤵
                                      PID:6032
                                    • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                      "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                      13⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3612
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat"
                                        14⤵
                                          PID:5556
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            15⤵
                                              PID:1032
                                            • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                              "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                              15⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5592
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"
                                                16⤵
                                                  PID:1176
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    17⤵
                                                      PID:3736
                                                    • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                      "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                      17⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:628
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat"
                                                        18⤵
                                                          PID:2680
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            19⤵
                                                              PID:1936
                                                            • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                              "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                              19⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2192
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
                                                                20⤵
                                                                  PID:2080
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    21⤵
                                                                      PID:2308
                                                                    • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                                      "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                                      21⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6100
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"
                                                                        22⤵
                                                                          PID:4644
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            23⤵
                                                                              PID:1144
                                                                            • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                                              "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                                              23⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3284
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"
                                                                                24⤵
                                                                                  PID:4960
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    25⤵
                                                                                      PID:2424
                                                                                    • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                                                      "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                                                      25⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3068
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
                                                                                        26⤵
                                                                                          PID:1840
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            27⤵
                                                                                              PID:812
                                                                                            • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                                                              "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                                                              27⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:5256
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
                                                                                                28⤵
                                                                                                  PID:5372
                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                    29⤵
                                                                                                      PID:5540
                                                                                                    • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                                                                      "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                                                                      29⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:5976
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"
                                                                                                        30⤵
                                                                                                          PID:2644
                                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                            31⤵
                                                                                                              PID:3868
                                                                                                            • C:\Program Files (x86)\Windows Mail\winlogon.exe
                                                                                                              "C:\Program Files (x86)\Windows Mail\winlogon.exe"
                                                                                                              31⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:5420
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"
                                                                                                                32⤵
                                                                                                                  PID:1924
                                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                    33⤵
                                                                                                                      PID:5272
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\WmiPrvSE.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4420
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4188
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\WmiPrvSE.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2892
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Templates\csrss.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3080
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2248
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1952
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5080
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4852
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4424
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sppsvc.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4116
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2932
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4552
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\sysmon.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2344
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3132
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1272
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2652
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3328
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2972
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\providercommon\upfc.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4988
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4936
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2832
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1992
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4476
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:640
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:396
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2484
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1780
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\providercommon\SearchApp.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3144
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3972
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4516
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3612
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1816
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\conhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3700
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1192
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1056
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\System32\Speech\Engines\TTS\cmd.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1152
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4460
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2644
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\wininit.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3764
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\taskhostw.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4824
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\es-ES\taskhostw.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3052
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\taskhostw.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2340
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4288
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1576
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4656
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1840
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2156
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\unsecapp.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1756
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2296
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2104
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2204
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:228
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4404
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2528

                                                    Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                            SHA1

                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                            SHA256

                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                            SHA512

                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            baf55b95da4a601229647f25dad12878

                                                            SHA1

                                                            abc16954ebfd213733c4493fc1910164d825cac8

                                                            SHA256

                                                            ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                            SHA512

                                                            24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            6d3e9c29fe44e90aae6ed30ccf799ca8

                                                            SHA1

                                                            c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                            SHA256

                                                            2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                            SHA512

                                                            60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            62623d22bd9e037191765d5083ce16a3

                                                            SHA1

                                                            4a07da6872672f715a4780513d95ed8ddeefd259

                                                            SHA256

                                                            95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                            SHA512

                                                            9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            cadef9abd087803c630df65264a6c81c

                                                            SHA1

                                                            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                            SHA256

                                                            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                            SHA512

                                                            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            d28a889fd956d5cb3accfbaf1143eb6f

                                                            SHA1

                                                            157ba54b365341f8ff06707d996b3635da8446f7

                                                            SHA256

                                                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                            SHA512

                                                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            bd5940f08d0be56e65e5f2aaf47c538e

                                                            SHA1

                                                            d7e31b87866e5e383ab5499da64aba50f03e8443

                                                            SHA256

                                                            2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                            SHA512

                                                            c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            59d97011e091004eaffb9816aa0b9abd

                                                            SHA1

                                                            1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                            SHA256

                                                            18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                            SHA512

                                                            d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            28d4235aa2e6d782751f980ceb6e5021

                                                            SHA1

                                                            f5d82d56acd642b9fc4b963f684fd6b78f25a140

                                                            SHA256

                                                            8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

                                                            SHA512

                                                            dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            e243a38635ff9a06c87c2a61a2200656

                                                            SHA1

                                                            ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                            SHA256

                                                            af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                            SHA512

                                                            4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                          • C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            2ca881c026bc4511cb8b7c4a12d39ffc

                                                            SHA1

                                                            2ff8658b82e60a93d8ea95dd133914d6871a454b

                                                            SHA256

                                                            bbc351e33a44da33ea217d3c3ca1e50a867c502ec197c4b5f8e5e69ed350a795

                                                            SHA512

                                                            dadae151f0abac4b431de8871439bb5c1bcbd1154cdd329b71c2c755c74b566a764efa0dd09f0f18263b8fac6209efa0e6ac0ef45c78aab03608364b65d2965d

                                                          • C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            ce143d630626a2d5a4294f788e9b2b20

                                                            SHA1

                                                            81e961f2218581091bc13428a054ab3405a22eeb

                                                            SHA256

                                                            98733cf464ce68f872e698dbbb11a3429bdbced3f2853c80fb57ea364179742a

                                                            SHA512

                                                            1881a7d2643041d7b2cfcd7592e4387b986f36fa79875b2565ce86fa675ff1bb142e86c667c1967a0137e836339201d810038e922aac2993686e4ad28f94fd40

                                                          • C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            dccc3c0e0b065a5ccb6775ecb6140cae

                                                            SHA1

                                                            6efc17405500876e27917e15cc988ad177688e6d

                                                            SHA256

                                                            b838ec9ee060a13400e061f07f3d76b6a5bf8e9fcbbd6e2e1207354a26d13ca8

                                                            SHA512

                                                            e3bba5a1dc6f69f8cc0ccc48063beb3fe7b821bc455dd4fe28e554057a1fcbae12caae888484f401a7aa7e851df3c558abf79e9a96e3201cb657e72aded19ea4

                                                          • C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            56e3c6d5e2a145f2c81f2b70f012e2c9

                                                            SHA1

                                                            32aed2124bb255f7a6dc998cd9f626babed773bd

                                                            SHA256

                                                            793d47145486e42e49ba4f9923ecfd8edcd50b9537f72d159e653a7206637ef2

                                                            SHA512

                                                            5c5980660fb05e9ed95cf05b53c11748e310b0a553cb833199bc445311ad0997990a6730665d169396262529442237f96bd89743dbadb3713466820e07c39c01

                                                          • C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            1de644a275ff55be0309b09be423a03f

                                                            SHA1

                                                            133fe0e1ac46f277109e7e6e67f5c0bbc195a536

                                                            SHA256

                                                            1ed5a6b899af1228e5ed5ffff4526a9e896d3b2fb48723e302828931588fc415

                                                            SHA512

                                                            97cf72a8b1260bcea16baeb7ce23532d6e44c7538c97988d27d2ecf76d7ffedfe941db829ace3162ccf1d1f5da9be2e488667e7a5abac3ef8fa4b43a76d929d7

                                                          • C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            c8197a0e2c000eecd96cfed250baa4d2

                                                            SHA1

                                                            4666e3adca6c4610199cc5684761305c12552f2b

                                                            SHA256

                                                            58c0366c245014c096c611aa2ddeb7e245cf15200b97045b0883d47e44188020

                                                            SHA512

                                                            e58061af06a061520a7e0a71d4ef5a99e738b9769a6175647b2d97b607f2f7a76d333035bc4808c09e62bab8ca39869d43929c3f62ebf6a358164c7e47805ee0

                                                          • C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            657d95cecab7e435772fcda86f61dfa2

                                                            SHA1

                                                            9431e344a88b13bc23410b39f90016ac6485d23d

                                                            SHA256

                                                            fa22e263a139d299059445088300445b7ff657c77b25266d8ac069b59b606713

                                                            SHA512

                                                            7e6abb9a98bd13480a0f7e8fdffa792a10e98224cd55ee80bcde8e5de496d75ea005c09ea3f1c463cfa0cb1b69799c76de3a8d1385f47e8f6d3a59351dfcad2d

                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cs5l4q4o.g1w.ps1

                                                            Filesize

                                                            60B

                                                            MD5

                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                            SHA1

                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                            SHA256

                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                            SHA512

                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                          • C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            4e2beb1169a4c851c5077b7da6ade09f

                                                            SHA1

                                                            f395568acf803acf1575a96029e7b2406ad40d39

                                                            SHA256

                                                            5c5889ac7fd4024a51492eb38bfa160ac606ddadbf4663c9046ca1e6a548d10e

                                                            SHA512

                                                            fcdc4c52cceacd24371e0f013e424735e3239b8e1b1f22c10aaf9e2c39ea49bc950103df020031d19b424e8128ca0de462706151848a265589968320f0d3eaca

                                                          • C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            9acbf272a436ad6c665a0981fad6fa6a

                                                            SHA1

                                                            ceb5d1937b19a853917d3d15da2647b3ab8789fe

                                                            SHA256

                                                            5ab86b7c2fd428c9f6ed17d8f5a640c518046dd9fc7dd268b14fc6993dd6c9f0

                                                            SHA512

                                                            1ec10d2fb489f067c6b3a60922e1cb11e9366b0158f80db46d128e38cd35e9c63d7e0b4883296064442c33e358a9cfac8cd38e9803876a5c8790c1d81d020265

                                                          • C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            77854fb801e91507ae46e6e5b4458638

                                                            SHA1

                                                            6b282a2fcc652f10592c5885e14fc08967015d25

                                                            SHA256

                                                            b13d7ac8a5f6740c789b754c5976d2f9b594b999dfcb2c61e227f756b0f99780

                                                            SHA512

                                                            e9bd163e187766619cec16698ed2008fc81f258cc39bcb97da6025d20ecf9f30ccd30b54748e8581557f759fe4ada3adf3a60c3024aa9c0dfda9f8e2183d1979

                                                          • C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            89c13092cb05c74954a8d628e1fe3b6f

                                                            SHA1

                                                            1842dfa68efab86a646db7d0c6a12d74bce3471e

                                                            SHA256

                                                            243246295492ae2f6eeb2e8b8da4912e6ba2fc06a3cf00ae74f76a97578303bb

                                                            SHA512

                                                            43d25343b15d1883d025da6942094cfac235ea7b444afcc72b16037c3bac82434a908c29794d09f25da69a832f172d0d5bfa122bd25008224f32cef4e760294a

                                                          • C:\Users\Admin\AppData\Local\Temp\p5ITN63wlJ.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            8db40baf2939c131581ac39c6fb45933

                                                            SHA1

                                                            9e6ed957026dcb1f27012604a379e7976ff81fee

                                                            SHA256

                                                            a8d1bbdf3a550c0ba75083ab4d8f2d695636a060d65e75b4588f50b9ada4b634

                                                            SHA512

                                                            e8b249a9139134c7f1725802da93399bc94e64b4010935034c1cd54ba1bca150e8601c0d9811a11c66f4abb075fb5e68d6a1fcc9c670db0711c60091f9390394

                                                          • C:\Users\Admin\AppData\Local\Temp\ssDSZpddA3.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            4d2b623524d4b971ae3c8d5a981897f4

                                                            SHA1

                                                            e34fd1f93dce7661cdfcc4f5d8becc15d98ea4d5

                                                            SHA256

                                                            21d9d9dcc7c7e8b935485dc0e88f710cd3c176eb88853562cd43841bd0ce553a

                                                            SHA512

                                                            19d0928388bae5c2a596aafb649c36ff36c4aaec0cd444b7f721afdaf83b567cc8f8dd0c03dab37067de6cf15a0d855bb2b34be41479721c7bd80b873bca885d

                                                          • C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat

                                                            Filesize

                                                            213B

                                                            MD5

                                                            c6beb7483dd895ee3f18db9ccb9cb18e

                                                            SHA1

                                                            edfcdf74f279882cc1f9106fb943891f74afff8d

                                                            SHA256

                                                            b13dc4c773678be953e8f16ed237c73d9554ab1f4be117b3727621c17f143d05

                                                            SHA512

                                                            67530e6b3b9d770b88ccd2fe3c81ff33675c6d2a7aafbc5543d58121fb226f3c0390e85919bd7885edf3d46b1a9575b850bb15db37e6754379d22140d7174744

                                                          • C:\providercommon\1zu9dW.bat

                                                            Filesize

                                                            36B

                                                            MD5

                                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                                            SHA1

                                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                            SHA256

                                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                            SHA512

                                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                          • C:\providercommon\DllCommonsvc.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                            Filesize

                                                            197B

                                                            MD5

                                                            8088241160261560a02c84025d107592

                                                            SHA1

                                                            083121f7027557570994c9fc211df61730455bb5

                                                            SHA256

                                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                            SHA512

                                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                          • memory/628-315-0x0000000001610000-0x0000000001622000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/1176-69-0x00000174CBA10000-0x00000174CBA32000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/1460-15-0x00000000027C0000-0x00000000027CC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/1460-14-0x0000000002630000-0x0000000002642000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/1460-16-0x0000000002640000-0x000000000264C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/1460-17-0x00000000027B0000-0x00000000027BC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/1460-12-0x00007FFEC58C3000-0x00007FFEC58C5000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/1460-13-0x0000000000470000-0x0000000000580000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/2192-322-0x0000000002D40000-0x0000000002D52000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/2192-327-0x000000001C7C0000-0x000000001C969000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/3068-346-0x0000000002B80000-0x0000000002B92000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/3068-351-0x000000001C500000-0x000000001C6A9000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/3284-343-0x000000001C3B0000-0x000000001C559000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/3284-338-0x0000000002900000-0x0000000002912000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/5256-358-0x000000001C6E0000-0x000000001C889000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/5280-284-0x0000000000FF0000-0x0000000001002000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/5420-369-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/5420-374-0x000000001BE00000-0x000000001BFA9000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/5976-361-0x00000000025C0000-0x00000000025D2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/5976-367-0x000000001BDD0000-0x000000001BF79000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/6100-335-0x000000001BEF0000-0x000000001C099000-memory.dmp

                                                            Filesize

                                                            1.7MB

                                                          • memory/6100-330-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

                                                            Filesize

                                                            72KB