Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 02:27

General

  • Target

    JaffaCakes118_6967526d2772ad9afaf9d37407a183989f72032e43469452d45647e2a281771f.exe

  • Size

    1.3MB

  • MD5

    34df7506e76ceeb4d9d568da789a4a45

  • SHA1

    68b2e32ba9e0e438076f711bb50bc0ceb4e82b79

  • SHA256

    6967526d2772ad9afaf9d37407a183989f72032e43469452d45647e2a281771f

  • SHA512

    fe4d087bca3b893371688b2bbb5f7b1211b11cf6180c164dc728e115c87ff0bce7f913f7458f974d5ea540d0ba3e9bef84dc6ed3dcb4b95dcbda3ec7499ff1b9

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 51 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6967526d2772ad9afaf9d37407a183989f72032e43469452d45647e2a281771f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6967526d2772ad9afaf9d37407a183989f72032e43469452d45647e2a281771f.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2256
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\StartMenuExperienceHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4336
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2344
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\OfficeClickToRun.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1820
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4032
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1604
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4252
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4372
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2420
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2076
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1596
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\OfficeClickToRun.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\loc\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4528
          • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
            "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2864
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OTxxDhnLNa.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5672
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:5740
                • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                  "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:5848
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5976
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:6032
                      • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                        "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:6136
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lEFN0vw97k.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1168
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:1568
                            • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                              "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3452
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"
                                12⤵
                                  PID:5016
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    13⤵
                                      PID:4964
                                    • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                      "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                      13⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:780
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat"
                                        14⤵
                                          PID:2876
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            15⤵
                                              PID:2976
                                            • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                              "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                              15⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3940
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat"
                                                16⤵
                                                  PID:2040
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    17⤵
                                                      PID:4100
                                                    • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                      "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                      17⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3908
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat"
                                                        18⤵
                                                          PID:2212
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            19⤵
                                                              PID:2580
                                                            • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                              "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                              19⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3324
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat"
                                                                20⤵
                                                                  PID:5192
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    21⤵
                                                                      PID:3740
                                                                    • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                                      "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                                      21⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:776
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nc51i3GWIc.bat"
                                                                        22⤵
                                                                          PID:3808
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            23⤵
                                                                              PID:3412
                                                                            • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                                              "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                                              23⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4780
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat"
                                                                                24⤵
                                                                                  PID:3104
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    25⤵
                                                                                      PID:5452
                                                                                    • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                                                      "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                                                      25⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4028
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CWxqMEPA9M.bat"
                                                                                        26⤵
                                                                                          PID:2828
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            27⤵
                                                                                              PID:5720
                                                                                            • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                                                              "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                                                              27⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1140
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ESzt3JT3T8.bat"
                                                                                                28⤵
                                                                                                  PID:6028
                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                    29⤵
                                                                                                      PID:3868
                                                                                                    • C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe
                                                                                                      "C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe"
                                                                                                      29⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:5980
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat"
                                                                                                        30⤵
                                                                                                          PID:2160
                                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                            31⤵
                                                                                                              PID:3068
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1612
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1900
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:780
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1016
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2088
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\spoolsv.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4280
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2004
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2448
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteDesktops\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2696
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\OfficeClickToRun.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:388
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2204
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1204
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4880
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2868
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:940
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4324
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2832
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4664
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech\unsecapp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2660
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Speech\unsecapp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3136
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\Speech\unsecapp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2748
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1124
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3912
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4968
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1864
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3932
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2068
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\cmd.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3352
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Favorites\cmd.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4460
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Favorites\cmd.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1988
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2880
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:396
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:456
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:964
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2072
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:972
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4268
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2168
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3888
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\SearchApp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4540
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3572
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4476
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\OfficeClickToRun.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1640
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5008
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:224
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\root\loc\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4796
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\loc\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3828
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\root\loc\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3500
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:688
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5000
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2756

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        baf55b95da4a601229647f25dad12878

                                                        SHA1

                                                        abc16954ebfd213733c4493fc1910164d825cac8

                                                        SHA256

                                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                        SHA512

                                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                        SHA1

                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                        SHA256

                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                        SHA512

                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        6d42b6da621e8df5674e26b799c8e2aa

                                                        SHA1

                                                        ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                        SHA256

                                                        5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                        SHA512

                                                        53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        62623d22bd9e037191765d5083ce16a3

                                                        SHA1

                                                        4a07da6872672f715a4780513d95ed8ddeefd259

                                                        SHA256

                                                        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                        SHA512

                                                        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                                        SHA1

                                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                        SHA256

                                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                        SHA512

                                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        bd5940f08d0be56e65e5f2aaf47c538e

                                                        SHA1

                                                        d7e31b87866e5e383ab5499da64aba50f03e8443

                                                        SHA256

                                                        2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                        SHA512

                                                        c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        e243a38635ff9a06c87c2a61a2200656

                                                        SHA1

                                                        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                        SHA256

                                                        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                        SHA512

                                                        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        e448fe0d240184c6597a31d3be2ced58

                                                        SHA1

                                                        372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                                                        SHA256

                                                        c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                                                        SHA512

                                                        0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        28d4235aa2e6d782751f980ceb6e5021

                                                        SHA1

                                                        f5d82d56acd642b9fc4b963f684fd6b78f25a140

                                                        SHA256

                                                        8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

                                                        SHA512

                                                        dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        aaaac7c68d2b7997ed502c26fd9f65c2

                                                        SHA1

                                                        7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                                        SHA256

                                                        8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                                        SHA512

                                                        c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                                      • C:\Users\Admin\AppData\Local\Temp\CWxqMEPA9M.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        5b54ff9579820695f6df563fe47cdcec

                                                        SHA1

                                                        7e12d5b0021389753b582c6b74075eb747b48a88

                                                        SHA256

                                                        f733c20a8eb0559431e8921b182575ef07cc81fdc8bea3e3145de30bede9cba0

                                                        SHA512

                                                        59e337e21ac363d27753274518764ccb7b070a4b4ef805fef9e3cc03987a39a927cda71c09fe95e0c7fc6bd21f8296ca01f65645a7d8e70adc8bda4e0e65e8fa

                                                      • C:\Users\Admin\AppData\Local\Temp\ESzt3JT3T8.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        40cbb9830fa894c74cf80c47ff38f08b

                                                        SHA1

                                                        ba9c4409db1301cf70ae1d34d93a8d948e4433e7

                                                        SHA256

                                                        7f43ef8f3fbe4b4cf932ad42ba1646967fc4fe17978c053eb7149b0ae1c50889

                                                        SHA512

                                                        0ea79c86152b214632caf2a5b3dd3b6eef5a22bf5abdc951fa3c349f47c000039b526d8313b0a2dbc041dd5354c4ef5c90dc01ebc012b5d3fddfe4e0b4794584

                                                      • C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        272e4f2eecd8c8cf81b9eb4ef4274a67

                                                        SHA1

                                                        6e1f2115342db043fa314b6618e361cd3d9eb486

                                                        SHA256

                                                        899113d1a244a1f8af4875d26bf830602cd8b94270fc21c28850e25b68851894

                                                        SHA512

                                                        4a1c72c2ef2c87bb7bc734822b365d3e1de9b244be272300ba9ac34ca5c58d5ceb4202b3fecf57d6cbf92882c9036909d7e6df15797dcb9ffd6bdcb9a4729340

                                                      • C:\Users\Admin\AppData\Local\Temp\Nc51i3GWIc.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        ae9707ec8fe090ec6ac147bc71994f9d

                                                        SHA1

                                                        7a38d7ca331afad4ecb37abb6fd899884b9d472f

                                                        SHA256

                                                        940a35fdf174f08d0430c6d6ec7421dd1ff12bd1a96da8eb879dad11aba4cece

                                                        SHA512

                                                        bb0c8ee20315c86061848c6a46ce09ee5af59dfb188ef43e92b2e92d3c13f2ef6ede2e1df822ae62678b6d64fa98405ac09f479bff1d35343a4a5ee2d20ba2cb

                                                      • C:\Users\Admin\AppData\Local\Temp\OMb46N11BK.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        969a9cc15fffec738ee8b4627091a398

                                                        SHA1

                                                        4acd5c61549c154f246fc567578a7ed3c0003844

                                                        SHA256

                                                        25b4a6ca1a08899cb7b0c017e961684db13d3efa4451256b231268c52b491471

                                                        SHA512

                                                        077d1364a3fc29922d73478eed4c30afa631e627847e89adc1a6de71f678448fce9a51319c5ae05d7a375a7b9614fb344a5317200bc70dbc7c662da92415b790

                                                      • C:\Users\Admin\AppData\Local\Temp\OTxxDhnLNa.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        21b0112a9d31f0d63a16cf9fd9af55e1

                                                        SHA1

                                                        ce4713f9a4db3090e23812914a343e11b4706900

                                                        SHA256

                                                        c59f719e1cbea6a9ae273ca9b844ad165db93ba0a9c2b257b31defa45aa16c29

                                                        SHA512

                                                        c15617f845391c880af5e867843525c72cb1c76d40244527ad11f5253a45c8b237ec8ba97781820bee88cf717e3f82aadc7be3d0075d6745c0139f0651051dcd

                                                      • C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        0eabee644551e92423372234b5892e79

                                                        SHA1

                                                        5765c0fb138511871a6d5b2c0f11fa6a55c1c7a4

                                                        SHA256

                                                        efff2ac7b927e24464061b784f35994860d2eec29eb4764e07ad05c227587e06

                                                        SHA512

                                                        e7a1ca86e2df78d4cb37bad5fa693310778792159a714d33566e3368cf9f928ee014fd46e1c112f65e355b133a34053e4efe0c443412f5fb652d2fdeea4a1f7c

                                                      • C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        32035ff5d8e87460a1d6b8b9ab866fa3

                                                        SHA1

                                                        f1b0798df659ea3d4e61f6b5563abd36ae9c8847

                                                        SHA256

                                                        2edca5e49629477f6160d4a2626f461f80b22b6ed9dd79783d978790e89bdece

                                                        SHA512

                                                        3f1b90b39bbdf7d82622d3298ba4c9b1034572f98f1d207ec4b998de4e68021b88c23fb870f3e718390595ab8c48dc533b3ffef728aa2a5c81eadd49acf58115

                                                      • C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        d9c2e19a74f79b67bfb23d57d8c8d2b7

                                                        SHA1

                                                        8186c4a19982bb0078654535d5ead09986a35ddc

                                                        SHA256

                                                        df57302bce2d09686f3e14211432c901240d236e2a0d87edddd0fb831a91ca63

                                                        SHA512

                                                        b13730e260954bb1c39d994ac099c16ab71a90655fb904a322898c8578f7b9eea171aef35bcd0e5e4ace155374a34c2e667a94768d9031b4bc55db1597f1d67c

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1jpbhjql.n2i.ps1

                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      • C:\Users\Admin\AppData\Local\Temp\h6hK16ZrMt.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        68800c1ab94490c24595907d3f0938c4

                                                        SHA1

                                                        c253ff7ab08bcde0da31b7d8f56268460377478f

                                                        SHA256

                                                        3eb43415d569f761ed4a9dd15c22c1c2edc78bdd9ad894efe56267c12305fdd9

                                                        SHA512

                                                        59a0b62fd7ffd4226b79d09ad9010bbbd90ed33e780db24675696d1a74c8c02b11e3a4160aab836d997196edf92666b03cec9000ddfe73d718e5c52642dbbb86

                                                      • C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        9eec8efff5e3d31273483618a5e9f32a

                                                        SHA1

                                                        8bb53c8f1ee63179ffce11231a229b9eb5f9fe3d

                                                        SHA256

                                                        f6e64c29aec854ebeda5df3818355c3f44ee95620283815da1d0d3e399e9175a

                                                        SHA512

                                                        3e881fea31ecf03d72c34b1fdb39eb032deb35012bdf65f7346da57858351bca0f8b1c8c2dfff45dff58ec289244efb2536eafec4475ae6bf5f4e7ee06d86e3d

                                                      • C:\Users\Admin\AppData\Local\Temp\lEFN0vw97k.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        d520b07f72805fdab6e57de5fc98c6f4

                                                        SHA1

                                                        fa9fb04b4f308810987d35dbf0c1daf61d155a74

                                                        SHA256

                                                        8049b0094c0bce001dff3c3f351fde10d3d8f8cee05cc5506e3ea44b84051898

                                                        SHA512

                                                        95a7dc4232eb03f060caf703de499c21a53928a0a4e375fbaaa3c02bc00872fc29c674f851dac373c7f796df77fd4bd5ade3499d1f5f8ce5feb3a7aa3f025f48

                                                      • C:\Users\Admin\AppData\Local\Temp\s1KW4B7p45.bat

                                                        Filesize

                                                        223B

                                                        MD5

                                                        27871d3ef3bc5961073f96a02df704c1

                                                        SHA1

                                                        9da40bc46073623acee85d90e38f3a67d6d67daf

                                                        SHA256

                                                        ad5125620f7e84d50f3928f1f7fce6103f6e3ac285a0901baba8663122020ffd

                                                        SHA512

                                                        6d5ac57c32c82f485f4430c35b1b7a32e295640d662e55f3d13e6b54d175cfb6058d0950c987038ed7b3b0942a548165677cb33870228196c2bd7588770f06f4

                                                      • C:\providercommon\1zu9dW.bat

                                                        Filesize

                                                        36B

                                                        MD5

                                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                                        SHA1

                                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                        SHA256

                                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                        SHA512

                                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                      • C:\providercommon\DllCommonsvc.exe

                                                        Filesize

                                                        1.0MB

                                                        MD5

                                                        bd31e94b4143c4ce49c17d3af46bcad0

                                                        SHA1

                                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                        SHA256

                                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                        SHA512

                                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                        Filesize

                                                        197B

                                                        MD5

                                                        8088241160261560a02c84025d107592

                                                        SHA1

                                                        083121f7027557570994c9fc211df61730455bb5

                                                        SHA256

                                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                        SHA512

                                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                      • memory/776-316-0x000000001BDF0000-0x000000001BE02000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/780-291-0x000000001BFF0000-0x000000001C002000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/1604-63-0x00000121E8370000-0x00000121E8392000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/2864-168-0x000000001BBE0000-0x000000001BBF2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/4132-17-0x0000000002990000-0x000000000299C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/4132-16-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/4132-15-0x0000000002980000-0x000000000298C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/4132-14-0x0000000000CF0000-0x0000000000D02000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/4132-13-0x0000000000530000-0x0000000000640000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                      • memory/4132-12-0x00007FFC76913000-0x00007FFC76915000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/5848-272-0x000000001B7F0000-0x000000001B802000-memory.dmp

                                                        Filesize

                                                        72KB