Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 18:52

General

  • Target

    JaffaCakes118_b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38.exe

  • Size

    1.3MB

  • MD5

    8131ad0751651e8b589c792e7ab051e8

  • SHA1

    52ee387141b497b3f6719038bc15966de82f7641

  • SHA256

    b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38

  • SHA512

    454c1a1aa29931e9e22d7267e5f4188d9f638957fe14f79d2f1e360511cc1c954d23975d701e6c26409df70f361b697fb4104a10705ef810e9d707502d81f2f1

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b549e4d3b566372561ed01c2d491e36e2d06d9fe7e5bcb5e7de1455f1d655c38.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2492
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1376
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4592
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:920
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\SppExtComObj.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2752
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4456
          • C:\providercommon\DllCommonsvc.exe
            "C:\providercommon\DllCommonsvc.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:312
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4344
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4692
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3292
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\winlogon.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4760
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2200
            • C:\Recovery\WindowsRE\powershell.exe
              "C:\Recovery\WindowsRE\powershell.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4040
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5284
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  8⤵
                    PID:4624
                  • C:\Recovery\WindowsRE\powershell.exe
                    "C:\Recovery\WindowsRE\powershell.exe"
                    8⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4400
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat"
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4600
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        10⤵
                          PID:4592
                        • C:\Recovery\WindowsRE\powershell.exe
                          "C:\Recovery\WindowsRE\powershell.exe"
                          10⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3956
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
                            11⤵
                            • Suspicious use of WriteProcessMemory
                            PID:236
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              12⤵
                                PID:5056
                              • C:\Recovery\WindowsRE\powershell.exe
                                "C:\Recovery\WindowsRE\powershell.exe"
                                12⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1640
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\83zFD3riGi.bat"
                                  13⤵
                                    PID:2256
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:1260
                                      • C:\Recovery\WindowsRE\powershell.exe
                                        "C:\Recovery\WindowsRE\powershell.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3508
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat"
                                          15⤵
                                            PID:2348
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              16⤵
                                                PID:5144
                                              • C:\Recovery\WindowsRE\powershell.exe
                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                16⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4392
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O1BWw2qr2X.bat"
                                                  17⤵
                                                    PID:5192
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      18⤵
                                                        PID:4336
                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                        18⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2320
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat"
                                                          19⤵
                                                            PID:1476
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              20⤵
                                                                PID:5780
                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                20⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5996
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"
                                                                  21⤵
                                                                    PID:5312
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      22⤵
                                                                        PID:5188
                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                        22⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5732
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D6YKtyItKL.bat"
                                                                          23⤵
                                                                            PID:4980
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              24⤵
                                                                                PID:1920
                                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                                24⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3836
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"
                                                                                  25⤵
                                                                                    PID:4968
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      26⤵
                                                                                        PID:4600
                                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                                        26⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5028
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KteTxDTZHh.bat"
                                                                                          27⤵
                                                                                            PID:792
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              28⤵
                                                                                                PID:2136
                                                                                              • C:\Recovery\WindowsRE\powershell.exe
                                                                                                "C:\Recovery\WindowsRE\powershell.exe"
                                                                                                28⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4616
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"
                                                                                                  29⤵
                                                                                                    PID:2328
                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                      30⤵
                                                                                                        PID:3536
                                                                                                      • C:\Recovery\WindowsRE\powershell.exe
                                                                                                        "C:\Recovery\WindowsRE\powershell.exe"
                                                                                                        30⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:816
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"
                                                                                                          31⤵
                                                                                                            PID:3632
                                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                              32⤵
                                                                                                                PID:5656
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1344
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4728
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2276
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4368
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4200
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2092
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\spoolsv.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4400
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Music\spoolsv.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5084
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\spoolsv.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4772
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4308
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1728
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1552
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2616
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2852
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5020
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1752
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:792
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:232
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\My Documents\SppExtComObj.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3656
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\My Documents\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3364
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\My Documents\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2952
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\attachments\explorer.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2860
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\explorer.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:740
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\attachments\explorer.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1176
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3376
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:752
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1324
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\lsass.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5080
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:852
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3488
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4264
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4748
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4068
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2224
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3744
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4040
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3680
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3944
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1520
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1380
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1176
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3288
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\winlogon.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2064
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\winlogon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3488
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\winlogon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4232
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4152
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4312
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:336

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        7f3c0ae41f0d9ae10a8985a2c327b8fb

                                                        SHA1

                                                        d58622bf6b5071beacf3b35bb505bde2000983e3

                                                        SHA256

                                                        519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                                        SHA512

                                                        8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                        SHA1

                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                        SHA256

                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                        SHA512

                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        d28a889fd956d5cb3accfbaf1143eb6f

                                                        SHA1

                                                        157ba54b365341f8ff06707d996b3635da8446f7

                                                        SHA256

                                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                        SHA512

                                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        62623d22bd9e037191765d5083ce16a3

                                                        SHA1

                                                        4a07da6872672f715a4780513d95ed8ddeefd259

                                                        SHA256

                                                        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                        SHA512

                                                        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        cadef9abd087803c630df65264a6c81c

                                                        SHA1

                                                        babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                        SHA256

                                                        cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                        SHA512

                                                        7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                                        SHA1

                                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                        SHA256

                                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                        SHA512

                                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        bd5940f08d0be56e65e5f2aaf47c538e

                                                        SHA1

                                                        d7e31b87866e5e383ab5499da64aba50f03e8443

                                                        SHA256

                                                        2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                        SHA512

                                                        c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                                        SHA1

                                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                        SHA256

                                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                        SHA512

                                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Filesize

                                                        944B

                                                        MD5

                                                        2e907f77659a6601fcc408274894da2e

                                                        SHA1

                                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                        SHA256

                                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                        SHA512

                                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                      • C:\Users\Admin\AppData\Local\Temp\83zFD3riGi.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        3da2184e9ca576ec4e4aa9326bc884b5

                                                        SHA1

                                                        ac63188450db4a1161856fff158aacfceb2983c7

                                                        SHA256

                                                        16ee64506927acc66ce15d3956b6aa45be29a852dbefd75f077498b0e6b6b0ec

                                                        SHA512

                                                        dae68048d0e12b604e34cd65ab8b0b43e4ee4dfe84c56792b94b274aff4e928ebb117ccc75f040112a04132287b58c36e088a8e950d68cb8875794202026c137

                                                      • C:\Users\Admin\AppData\Local\Temp\D6YKtyItKL.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        32932618f2626b36994b409907873181

                                                        SHA1

                                                        1da001b45c2455cf22375104dffc8c98d640a29a

                                                        SHA256

                                                        bb5ebc78a9147f3580fd8cb2ed406931b32c33c875c85ea56f4db80c91051796

                                                        SHA512

                                                        c7382ed4026754eb098443eaa23e11503cf7c266f23a4b572b9e20662b199d07e17e58d5d24a8ad673384af561f04f16a9ec83db0ef560d5e2d0fc4c3838539c

                                                      • C:\Users\Admin\AppData\Local\Temp\KteTxDTZHh.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        85d82ce2ad3899c6e5e31bf4f6c1a67a

                                                        SHA1

                                                        8308bce1117931a10ef7c3ee0ba1eb6ad7c6e494

                                                        SHA256

                                                        2b982903f095ac613cd825db017728db8f587c7a4fbe6605c1f654a10ceebcaf

                                                        SHA512

                                                        bed9f684d8b4bc05cf7bafa885b7fee94a9823d785210cf84d0e72f5110c3fe5f44ab151c386230a909ee416eed6fc7d0cc2d1e8b83f62667bfc80fc0a0a4d7e

                                                      • C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        357ede9fbc9fee1e8ae07ba44db06793

                                                        SHA1

                                                        782f383f28bc2b58b24b498b2e4faabc23286275

                                                        SHA256

                                                        27e11d90b69fa8bf7710f5bcf010a29c9859f649538362cdd432c38f493e0328

                                                        SHA512

                                                        b5d6b94602eafacee8fbb312b9d625b755a2b557db0dfe31155dafd5911a570429dcb9ada945068467c8997ed4202343f32541dcba8193af92fa1008cd0b0e4d

                                                      • C:\Users\Admin\AppData\Local\Temp\O1BWw2qr2X.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        2f93a176d13a1f13509fb2bf5e1a6604

                                                        SHA1

                                                        8ed4b4f6c685c41388f39d589ae59ed44fe987a8

                                                        SHA256

                                                        a7f0b27db79816da9cddfc5a7b4410e1fbb528ada92d0a11657a9d30c7edddf2

                                                        SHA512

                                                        176eb60dc24b94ff171d4f2c8f5a7b74fdfc70c917e9198526791a41ccdd4e3cf1080cfe3166cb31c2f2054277b2191325e30b2a1b7665cf36fceff7295775c0

                                                      • C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        a4b6a3ea1a535acb490e1f6719f9d013

                                                        SHA1

                                                        d0bb25f9a00209dd20e2de232fa81a6aba1aaa08

                                                        SHA256

                                                        9f413a9a3cf7504d8f5d7916059fc2275162bba63af2d3295b5ebff9b9b9b58b

                                                        SHA512

                                                        175d42e60c8cf7f8e33654fc5f3fb189435229f022f5bb4250c532f6ea79d8292a9ad896084d8b3c35a50590f89e926be2b6980bd6ce5b4cb7c1b3f5bd3a9247

                                                      • C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        227ede269e03b3ee19ce6b7686e7dd79

                                                        SHA1

                                                        fd7adaef813d3130d6b430d3570f748ff93cca7b

                                                        SHA256

                                                        836431b6a8a657ec6b74e08eaf83c5cf14d869794f97600c97ebe3b58260bc76

                                                        SHA512

                                                        685f97b753be78cd3938f73eecd9bb1d746e366aeb31b668bd1502d6a1035192d46232224852c44054b3d8f91500089e8ca8fbe3d9222db48706e6841b0bdbca

                                                      • C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        85aef69f3c0b64827016a8a8197b108b

                                                        SHA1

                                                        ddfa6b8f81caccaecd9821e44b306781f667dd80

                                                        SHA256

                                                        a811967551fb9ffe1d0f86256196cb2c72174c7bdf0150b7b7cc710ac4dab6e8

                                                        SHA512

                                                        9d6a90dab7c6649efbe920e10103d452372c137b4f7eb0ecbffc1121096d3bccc41ee36863a26a0badccdb0ea5d5b978d0defea2c370b14aebf64c242159ca16

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qbpw0rqp.uaj.ps1

                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      • C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        d8afc7c1914ad9069fd0f95b09472265

                                                        SHA1

                                                        0807c3a07cbcee822fdee7b2c31ff4b172990078

                                                        SHA256

                                                        14dc19a8e317fa17282a943425f4c282cd25719556c366e4348e2b05722cce68

                                                        SHA512

                                                        fe506e02b004cb1ff22e5875a865d7ad6802ec5cebaed5e22fb3c8420ab752e741ea3d72f6150089d908eb0bfe13026cd2f0ffc771f6b6fbf69f270c34bfa9c4

                                                      • C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        aa6150b0c11e410d2281b9a363df7a17

                                                        SHA1

                                                        163e1ccb22507efeb761716e750b82d1304f4e88

                                                        SHA256

                                                        77fd81b863ca0918b81ee637e914afdf51476a7bc65e9dadeaabba274731aec0

                                                        SHA512

                                                        97b24fb48b763a62ad73ba5145d340d008fa01b16b9b29137b31edb23109d9ca430534d9f82f7702b32d178931d6b2ce89113a334056c5c9a666fb9c6f95593c

                                                      • C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        abc4a0cadb335f65dade13e7ecbeeaf7

                                                        SHA1

                                                        544134a899019bb1ab5c322b39e80b545f1093ff

                                                        SHA256

                                                        4cc08d9ac9b36bed22acfda5cdd87f81cf04080af7fc6208ab2469adee889aed

                                                        SHA512

                                                        93d4dbb93f400ac59a8fad67b9d6bd541f28ea05477b096d05e38e4ba5cc593c86f3f7c105a93ffc1281e557f97fe8bbad10d47228afae62d5404f93675b0f82

                                                      • C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        f9536d3e1488089544141697c154eccf

                                                        SHA1

                                                        fa4db74b45729cc55595901ca14e3e3c5a862979

                                                        SHA256

                                                        06394a3117c920d4127afe95f03dc6d92ea5decf46cca50cf576dd6149e6c6a5

                                                        SHA512

                                                        86bb2a938055101c906ac0ccd5c55b9461021c7e102be5c739f5c5c753b482c3f2440a8b5cde2cc1dd44ac35dd728ced5447ca34bfe34fe02813d8523b1f2489

                                                      • C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat

                                                        Filesize

                                                        201B

                                                        MD5

                                                        3b74c0e4cde594e297f672f8aaf57926

                                                        SHA1

                                                        320ab4593c793b6608027a27391579f8af78a02c

                                                        SHA256

                                                        af3f469630da552dc6cf4149d916bb4b34682dfe2171ce4450937b55124fec08

                                                        SHA512

                                                        a407b2766b82ec235ad7f5397cd903118c307fa2ed29c7364fb037f30de94779229039c3b4b400330d51890fb0c3e41439d0a0552f48d71827e25f509f92bf21

                                                      • C:\providercommon\1zu9dW.bat

                                                        Filesize

                                                        36B

                                                        MD5

                                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                                        SHA1

                                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                        SHA256

                                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                        SHA512

                                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                      • C:\providercommon\DllCommonsvc.exe

                                                        Filesize

                                                        1.0MB

                                                        MD5

                                                        bd31e94b4143c4ce49c17d3af46bcad0

                                                        SHA1

                                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                        SHA256

                                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                        SHA512

                                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                        Filesize

                                                        197B

                                                        MD5

                                                        8088241160261560a02c84025d107592

                                                        SHA1

                                                        083121f7027557570994c9fc211df61730455bb5

                                                        SHA256

                                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                        SHA512

                                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                      • memory/312-119-0x0000000001440000-0x0000000001452000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/816-342-0x0000000003070000-0x0000000003082000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/2320-300-0x00000000028F0000-0x0000000002902000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/3508-287-0x0000000002880000-0x0000000002892000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/3836-321-0x0000000000B00000-0x0000000000B12000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/4400-272-0x000000001C7F0000-0x000000001C95A000-memory.dmp

                                                        Filesize

                                                        1.4MB

                                                      • memory/4456-50-0x0000021AEE7A0000-0x0000021AEE7C2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/4616-335-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/5028-328-0x00000000008F0000-0x0000000000902000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/5104-13-0x0000000000B30000-0x0000000000C40000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                      • memory/5104-12-0x00007FFCFB2C3000-0x00007FFCFB2C5000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/5104-14-0x0000000001390000-0x00000000013A2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/5104-15-0x00000000015B0000-0x00000000015BC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/5104-16-0x00000000015C0000-0x00000000015CC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/5104-17-0x0000000002E80000-0x0000000002E8C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                      • memory/5732-314-0x0000000002E00000-0x0000000002E12000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/5996-307-0x0000000002D70000-0x0000000002D82000-memory.dmp

                                                        Filesize

                                                        72KB