Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 02:27

General

  • Target

    JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe

  • Size

    1.3MB

  • MD5

    0497cf9a742024a9c551e2ada1e26d1a

  • SHA1

    d335627e11555de708ef8e1dfdc7cda8f42f20c5

  • SHA256

    1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5

  • SHA512

    61a1083be3af761f59cccc7e8956a5f08194260a69df34a3a268b12db9743d179488d5512ecb7b084a4e26ebf991f5986b2b411576de5d72dc4e66b22ff24132

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d9a9419adc05a53c2fd59e30f1fd36800f4b023aeed60bc1a5b936f2a3a0fc5.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4100
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3476
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4592
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1808
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4252
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4308
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4684
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\reports\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4268
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4632
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4920
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\taskhostw.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3088
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3560
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2100
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3092
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NmXefpDXun.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2388
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1056
              • C:\Users\Default User\sysmon.exe
                "C:\Users\Default User\sysmon.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5784
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6020
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:6092
                    • C:\Users\Default User\sysmon.exe
                      "C:\Users\Default User\sysmon.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:5356
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3512
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:1420
                          • C:\Users\Default User\sysmon.exe
                            "C:\Users\Default User\sysmon.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4276
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"
                              11⤵
                                PID:1320
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  12⤵
                                    PID:4900
                                  • C:\Users\Default User\sysmon.exe
                                    "C:\Users\Default User\sysmon.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5160
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"
                                      13⤵
                                        PID:3584
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          14⤵
                                            PID:3672
                                          • C:\Users\Default User\sysmon.exe
                                            "C:\Users\Default User\sysmon.exe"
                                            14⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5200
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
                                              15⤵
                                                PID:2668
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  16⤵
                                                    PID:4852
                                                  • C:\Users\Default User\sysmon.exe
                                                    "C:\Users\Default User\sysmon.exe"
                                                    16⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5208
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat"
                                                      17⤵
                                                        PID:2576
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          18⤵
                                                            PID:5236
                                                          • C:\Users\Default User\sysmon.exe
                                                            "C:\Users\Default User\sysmon.exe"
                                                            18⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5128
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
                                                              19⤵
                                                                PID:5564
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  20⤵
                                                                    PID:5768
                                                                  • C:\Users\Default User\sysmon.exe
                                                                    "C:\Users\Default User\sysmon.exe"
                                                                    20⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5796
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"
                                                                      21⤵
                                                                        PID:6004
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          22⤵
                                                                            PID:6108
                                                                          • C:\Users\Default User\sysmon.exe
                                                                            "C:\Users\Default User\sysmon.exe"
                                                                            22⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1060
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
                                                                              23⤵
                                                                                PID:5580
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  24⤵
                                                                                    PID:520
                                                                                  • C:\Users\Default User\sysmon.exe
                                                                                    "C:\Users\Default User\sysmon.exe"
                                                                                    24⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:632
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"
                                                                                      25⤵
                                                                                        PID:3588
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          26⤵
                                                                                            PID:3512
                                                                                          • C:\Users\Default User\sysmon.exe
                                                                                            "C:\Users\Default User\sysmon.exe"
                                                                                            26⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1188
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KmPq9HzxB6.bat"
                                                                                              27⤵
                                                                                                PID:5032
                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                  28⤵
                                                                                                    PID:4244
                                                                                                  • C:\Users\Default User\sysmon.exe
                                                                                                    "C:\Users\Default User\sysmon.exe"
                                                                                                    28⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:916
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"
                                                                                                      29⤵
                                                                                                        PID:3656
                                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                          30⤵
                                                                                                            PID:540
                                                                                                          • C:\Users\Default User\sysmon.exe
                                                                                                            "C:\Users\Default User\sysmon.exe"
                                                                                                            30⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2792
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"
                                                                                                              31⤵
                                                                                                                PID:4368
                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                  32⤵
                                                                                                                    PID:2256
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3496
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3584
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2156
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1172
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:952
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4112
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Idle.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4464
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5108
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2768
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\sppsvc.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3032
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\de-DE\sppsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2720
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\sppsvc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:920
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4460
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5060
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\uninstall\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2668
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\SendTo\fontdrvhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2080
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3124
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SendTo\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4472
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\attachments\Idle.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2180
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2068
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\attachments\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2724
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\sysmon.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2500
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3340
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sysmon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1472
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\upfc.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1060
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\upfc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2444
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\reports\upfc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1900
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3356
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3576
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:516
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Music\fontdrvhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3028
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Music\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4604
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:8
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4768
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2288
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4276
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\taskhostw.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2364
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Logs\taskhostw.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4284
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\Logs\taskhostw.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2788
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1760
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1536
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4928
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1936
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3096
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3804
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\RuntimeBroker.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2408
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4048
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3116
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Videos\dllhost.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2280
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Videos\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1208
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Videos\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3980
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2564
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:5048
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1036

                                                    Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                            SHA1

                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                            SHA256

                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                            SHA512

                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            baf55b95da4a601229647f25dad12878

                                                            SHA1

                                                            abc16954ebfd213733c4493fc1910164d825cac8

                                                            SHA256

                                                            ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                            SHA512

                                                            24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            bd5940f08d0be56e65e5f2aaf47c538e

                                                            SHA1

                                                            d7e31b87866e5e383ab5499da64aba50f03e8443

                                                            SHA256

                                                            2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                            SHA512

                                                            c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            2e907f77659a6601fcc408274894da2e

                                                            SHA1

                                                            9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                            SHA256

                                                            385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                            SHA512

                                                            34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            cadef9abd087803c630df65264a6c81c

                                                            SHA1

                                                            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                            SHA256

                                                            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                            SHA512

                                                            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            59d97011e091004eaffb9816aa0b9abd

                                                            SHA1

                                                            1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                            SHA256

                                                            18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                            SHA512

                                                            d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                                            SHA1

                                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                            SHA256

                                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                            SHA512

                                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                          • C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            fcbca2febf0f38e8dfbefed50f369d60

                                                            SHA1

                                                            3d49dc1c4ea5a6c295b9fe5190bb31ec2c4e01e2

                                                            SHA256

                                                            1b7b6ac15643e9ccaf768b2b400e955b474d8a44a0db0a9fa3def5aff92c8b0c

                                                            SHA512

                                                            b6edb658f51914abafcdd5ad43962ebcff66fe568cd4cb6bacaba8f318f7c2188aa8b10f401652e7bd8574a7d38b0799a4833ec4e8020d3883f0a0daed9270e2

                                                          • C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            732848c65399a408e35ef4a27b4ad7e2

                                                            SHA1

                                                            760d3650b464c11eecd2173e0c953fa442497623

                                                            SHA256

                                                            ae35e5fdf7d7f64128ecb764bf5ff6d6d414edc5cedae03db8caaa3fc5c61418

                                                            SHA512

                                                            c99b25abf10ee57b533f342fa39b9b3c7c59e08aec14e1fcaaaefafb9ff999894b9cd8dd82aee92942539d65333c8ed1aa4254cecac9ca9343fcf1e57daf95ac

                                                          • C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            3ba4a74b27ac1dd10d12d279b85a11a7

                                                            SHA1

                                                            92be2159223edbdbde0ac03d3adaa66476628e10

                                                            SHA256

                                                            568f3c1da78d608013d19b44d55542283f8cb4a512c8a959c1808f1140a8210f

                                                            SHA512

                                                            55842beee58c79d17d2afb1edb24817d69b7928333398b62b27a87896f39f553e91bec62fc4ba6c8f0fb90085807feb7b3935202010e31c6ba908f6041408d10

                                                          • C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            0d2bf5538e8d24878782afbad04385a6

                                                            SHA1

                                                            d301ea05d8de0845ee0f957414e9e47e8fc4fb5f

                                                            SHA256

                                                            1d572ff731663df21fffbddf61935e10da1fd6fe0ca3805c3022cb6b7a773bd7

                                                            SHA512

                                                            fc21c046823efa977487c1d6bd6a2dfc009f84172bf341156e50b27b95e07b351916532940d66d182aad0146763f80540c36e7b8a521ec2d7497c96c00cdef7a

                                                          • C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            ba366bee325d9ab51e7bb4478c5a0db6

                                                            SHA1

                                                            92b7429ba819cc2ce7b4865d29bd3478f6c8be91

                                                            SHA256

                                                            37789820b6febcf2bfa61c12b462c0ace690f4d2941c41b5097ad77e94d1fede

                                                            SHA512

                                                            5f5523316ffc2f5e6680d6441e3e968a225587d1686f7cdac1888e46fbf11f0222d994e2fec169e9dd611e500be0e2e04fe547aa13adb0365ce3bd9f212bccb3

                                                          • C:\Users\Admin\AppData\Local\Temp\KmPq9HzxB6.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            0be4aa4b26467373ee4922afa483e427

                                                            SHA1

                                                            f592fe3a02c4e78b238adf1358c9a43f8bb2ade5

                                                            SHA256

                                                            344608ad0eba277dd358aaeeec00a892292a010a8e9a75a8f9209d6aed7b21e3

                                                            SHA512

                                                            26966ea3916142d2482e66c9378a59a851f276bb656b954c386b98316e15d52d4213a6a46483a27ffc851e4f652676a9878b12591fc9243fff49ce1b50897ab8

                                                          • C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            06df87d50d8a787d491ad599998e0d3c

                                                            SHA1

                                                            080a541a6c1976364fa2a35191842a71bd0ea2ec

                                                            SHA256

                                                            b612d36c408cc216a65d28bd88086cfaf62ee515628dd5e4cf2c999cea638562

                                                            SHA512

                                                            983c0f81a56060aca78384e186418de694fb524fc837fa7703c92fa176deb6a472a0bf23c011f0bab3824e340c323ba97ed8ef5735f41c565caf836b44cdc949

                                                          • C:\Users\Admin\AppData\Local\Temp\NmXefpDXun.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            464010774defeb31e9f85eee71da49ec

                                                            SHA1

                                                            66af8635709fc51a745d402d8d229bc546b45027

                                                            SHA256

                                                            61a66fd693eae2ec1080d45801bc9bcd7e3ec4065ae8083cf8747414a02e6f52

                                                            SHA512

                                                            8f21020672b9d4bc188ddb6984fa4049a0a6b03051843b897915536a33f1a8b8dd0119ffff876f2d048cd245c9dacef07df383d4d5da35eadad1d6516fde64cd

                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wt2ac5yk.tkl.ps1

                                                            Filesize

                                                            60B

                                                            MD5

                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                            SHA1

                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                            SHA256

                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                            SHA512

                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                          • C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            217999ff44ba63c185fa9fcce2949fd4

                                                            SHA1

                                                            8dcc56166cbe6ea40ac739c510ccbe2da4a57e48

                                                            SHA256

                                                            1b9af98e2435c82e621eefb217f35ee971d70563f8e37537d85424d8d50b546a

                                                            SHA512

                                                            0715027056527127e90b6ca9785d258e065fba61568aa6168adbc0b4a6d36c6024c26d8998ce12be20b328c643b0bb355725c7e4531e9fb810cd513b2e37756c

                                                          • C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            78e956d1968ad00d7d1ac1c2df6f931b

                                                            SHA1

                                                            0d224cbecf335015f9ef9e78e1dc068177236e45

                                                            SHA256

                                                            3666e14c54d4408bd40836b4ad7acf3b744f5ff56bf0710e7a9e0db2891b4f79

                                                            SHA512

                                                            73b838472cb04e1dc5e018dc18d6423a436821d2141644235bd8785b1a8869e5857b75e80400b69fa1402d87c1f4a9e549aa2f311d7917f88683191ed6b22b32

                                                          • C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            9005798d91c7f0a4acf67e0de96f1df9

                                                            SHA1

                                                            4c194daa1a3ddbe3b43547450c16465ed51983eb

                                                            SHA256

                                                            833adbbe9122f885cee05af3b9ec1be0e0c0e54947f9a83c29b88b86649ec4fe

                                                            SHA512

                                                            467cbe124eb65e04301ce9125d0edf241928c33bfd720561f9737449fe4a026f2783038f06e8a69d1273b85480c136d0a5743be7cafd08129e12888803d242eb

                                                          • C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            48466811f7be933cf4d03dc46550b9db

                                                            SHA1

                                                            a64179c9534e98e8819cbaf7df253b0994b1299f

                                                            SHA256

                                                            930866453b56e64ae5e99f463fe2640d6aa22779846101c3ecc3b068697f802d

                                                            SHA512

                                                            a0b4302a77dab7e4652f7d0c222f096660e9530689572e9bd131d3031699e01b49e1fc8bbf8b43354e39e8ecc9dc593e89f7fa77c1faba6875d53ac8aa6707ac

                                                          • C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat

                                                            Filesize

                                                            197B

                                                            MD5

                                                            bd84191065f5475833349426a7010132

                                                            SHA1

                                                            8ebd3a34f1d60cca945b80854e1089cb87b62ac2

                                                            SHA256

                                                            fc817a382d9b99601c4582a0a72fec43dee4b21b21e12167e1fca156d3cff39d

                                                            SHA512

                                                            6dbf9d0bec6f33d08c8c2ba57e830fc2211b60235ca3415b8301120059af62f2b1b7ed968199db316932793c0b65520ff845aa509aaef3b2610736a15260aace

                                                          • C:\providercommon\1zu9dW.bat

                                                            Filesize

                                                            36B

                                                            MD5

                                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                                            SHA1

                                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                            SHA256

                                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                            SHA512

                                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                          • C:\providercommon\DllCommonsvc.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                            Filesize

                                                            197B

                                                            MD5

                                                            8088241160261560a02c84025d107592

                                                            SHA1

                                                            083121f7027557570994c9fc211df61730455bb5

                                                            SHA256

                                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                            SHA512

                                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                          • memory/1808-68-0x000001F73F0C0000-0x000001F73F0E2000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/2792-353-0x0000000002CE0000-0x0000000002CF2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/3564-15-0x0000000000FB0000-0x0000000000FBC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/3564-14-0x0000000000FA0000-0x0000000000FB2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/3564-16-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/3564-13-0x00000000005D0000-0x00000000006E0000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/3564-12-0x00007FF9546C3000-0x00007FF9546C5000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/3564-17-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/5128-315-0x00000000026F0000-0x0000000002702000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/5208-308-0x0000000002260000-0x0000000002272000-memory.dmp

                                                            Filesize

                                                            72KB

                                                          • memory/5356-287-0x000000001B630000-0x000000001B732000-memory.dmp

                                                            Filesize

                                                            1.0MB

                                                          • memory/5784-279-0x000000001C070000-0x000000001C111000-memory.dmp

                                                            Filesize

                                                            644KB

                                                          • memory/5796-322-0x000000001ACA0000-0x000000001ACB2000-memory.dmp

                                                            Filesize

                                                            72KB