Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/11/2022, 04:28

General

  • Target

    e7713261b0f5c078bd49b8b96cd4fe7ad126224f4caab84f64e2c1afc05499ba.exe

  • Size

    1.3MB

  • MD5

    26304d88a3a25a6273c85a97f3dc72eb

  • SHA1

    c6969f453dc795e69298da79250a04175f6903d2

  • SHA256

    e7713261b0f5c078bd49b8b96cd4fe7ad126224f4caab84f64e2c1afc05499ba

  • SHA512

    85a9907ed3883d7cb8c2ee56ed3a1a235d3d6430356da93bcfc191b6db760df37fb35919c98e52a12972e6cc3f7aa9da4771e5cea3adcfc36069bfcdbc88bf4f

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 30 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 16 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 30 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7713261b0f5c078bd49b8b96cd4fe7ad126224f4caab84f64e2c1afc05499ba.exe
    "C:\Users\Admin\AppData\Local\Temp\e7713261b0f5c078bd49b8b96cd4fe7ad126224f4caab84f64e2c1afc05499ba.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1708
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\AvailableNetwork\sppsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:308
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\csrss.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2764
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2424
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z9h9y3ccMK.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1356
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:3824
              • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                6⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4404
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4956
                  • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                    "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                    8⤵
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3560
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat"
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4848
                      • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                        "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                        10⤵
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2740
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat"
                          11⤵
                          • Suspicious use of WriteProcessMemory
                          PID:32
                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                            "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                            12⤵
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5060
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hc9iMPvVJ4.bat"
                              13⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4056
                              • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                14⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1440
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat"
                                  15⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3496
                                  • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                    "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:60
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
                                      17⤵
                                        PID:4200
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          18⤵
                                            PID:3808
                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                            "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                            18⤵
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4792
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat"
                                              19⤵
                                                PID:2012
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  20⤵
                                                    PID:220
                                                  • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                                    "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                                    20⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2300
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat"
                                                      21⤵
                                                        PID:160
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          22⤵
                                                            PID:2800
                                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                                            "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                                            22⤵
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1392
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat"
                                                              23⤵
                                                                PID:3880
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  24⤵
                                                                    PID:2760
                                                                  • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                                                    "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                                                    24⤵
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4708
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat"
                                                                      25⤵
                                                                        PID:4760
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          26⤵
                                                                            PID:4880
                                                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                                                            "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                                                            26⤵
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:1364
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat"
                                                                              27⤵
                                                                                PID:740
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  28⤵
                                                                                    PID:4376
                                                                                  • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe
                                                                                    "C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe"
                                                                                    28⤵
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4420
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat"
                                                                                      29⤵
                                                                                        PID:2552
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          30⤵
                                                                                            PID:4960
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2004
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\DllCommonsvc.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:632
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\DllCommonsvc.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2184
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchUI.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2300
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\csrss.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:220
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3928
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3428
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:492
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2800
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:8
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4540
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4880
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4844
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\schemas\AvailableNetwork\sppsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3200
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 14 /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4384
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4580
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\DllCommonsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4416
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3188
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1620
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:816
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:912
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1380
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1300
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1360
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:968
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3212
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\DllCommonsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4604
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\DllCommonsvc.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4572
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4348
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4392
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4592
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 10 /tr "'C:\providercommon\SearchUI.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4596
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\sppsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3060
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\schemas\AvailableNetwork\sppsvc.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4484
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4980
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3196
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2780
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4352
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  1⤵
                                    PID:4504
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    1⤵
                                      PID:3588
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      1⤵
                                        PID:2676
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        1⤵
                                          PID:212
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          1⤵
                                            PID:2412

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\.oracle_jre_usage\RuntimeBroker.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                            Filesize

                                            1KB

                                            MD5

                                            d63ff49d7c92016feb39812e4db10419

                                            SHA1

                                            2307d5e35ca9864ffefc93acf8573ea995ba189b

                                            SHA256

                                            375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

                                            SHA512

                                            00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            3KB

                                            MD5

                                            8592ba100a78835a6b94d5949e13dfc1

                                            SHA1

                                            63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                            SHA256

                                            fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                            SHA512

                                            87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            7df5f2c570beb599062fdab471637d8c

                                            SHA1

                                            8bfb271bf5ee72317bb4f7a13ec5e253774bfaf6

                                            SHA256

                                            ceef3f3a35408fb4e58279a2e5ff3e0ec35af43b0056ba3b4f801575253125d0

                                            SHA512

                                            d1660703c53d970fab213e0b1f0a08e0770145aa093691536adccb92b486282f9356d6b47d6f7110c804ae326537c796663cc9ac9494e8b28cd064d09914a8f7

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            856a86d8558e8996c4b8795d5fe4efd5

                                            SHA1

                                            ca714efa06ed6869f0e8594b8aed5d459062cd67

                                            SHA256

                                            cc9fedbf6f33f4ec78ff790779b42d61aad1e90b2276e1357df5f06a30910179

                                            SHA512

                                            9150148fb1f99bb42e1a8969ab9c432a7361b8851d24fed27bb7e1717cb1cc60aaafecf89b770c0101684aab3cec20d888c7fe2b92015c3ca1bb45070119b7c1

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            856a86d8558e8996c4b8795d5fe4efd5

                                            SHA1

                                            ca714efa06ed6869f0e8594b8aed5d459062cd67

                                            SHA256

                                            cc9fedbf6f33f4ec78ff790779b42d61aad1e90b2276e1357df5f06a30910179

                                            SHA512

                                            9150148fb1f99bb42e1a8969ab9c432a7361b8851d24fed27bb7e1717cb1cc60aaafecf89b770c0101684aab3cec20d888c7fe2b92015c3ca1bb45070119b7c1

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            28d0f047b3f5975e5cc3240e08cb203a

                                            SHA1

                                            f9ee1e2f170a5a85f1362a0795fc826a02e5d91b

                                            SHA256

                                            88708b6aebf76f3d05c69d5bf988725fd727266f5158d50edd14a5bb2cf7923b

                                            SHA512

                                            e81b8da24eb8a6cca94a13160507d97c13976ca34660e3e1c038cf00b00e9cd7b7bcce801f954759f2ba7aa8e842f641f2049bc9ca5aa249b633beb28ff91639

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            e58ef30217fec5f0eac8a803860843ba

                                            SHA1

                                            c1147759d07162dec7a145d33a37a418545c307e

                                            SHA256

                                            26fdab3a412ce2889a95f23d6734fd6c279d1aea81a8a9c4eb286407deb2dafd

                                            SHA512

                                            cf02225d455449f81b9ed41b33d23214c27a9a329fa35ae4878da7d214bb63c1b0fbed26b010b18031c9de4b901811b005d65a2922c70b310d2de4221a28a46b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            e58ef30217fec5f0eac8a803860843ba

                                            SHA1

                                            c1147759d07162dec7a145d33a37a418545c307e

                                            SHA256

                                            26fdab3a412ce2889a95f23d6734fd6c279d1aea81a8a9c4eb286407deb2dafd

                                            SHA512

                                            cf02225d455449f81b9ed41b33d23214c27a9a329fa35ae4878da7d214bb63c1b0fbed26b010b18031c9de4b901811b005d65a2922c70b310d2de4221a28a46b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            d7b386cc246da8fffaf9f14949738f93

                                            SHA1

                                            0a977233ac0d8cd44dcd6b50f4f78ce0206e7672

                                            SHA256

                                            a4a3f28dfd8321ade1ebcccdfbe1492a643e78219a4a13965d769b677ffabdf6

                                            SHA512

                                            677cb9e856361a15943e9a3496f34c5a17282e7727a06f575030a02207948b3e016ea304f3becce3e28ac90939835b3eb30994b6869c6d519c73081d6a312403

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            14de95130481d303f5fa5923e56d3db2

                                            SHA1

                                            1b2f67c1b9d489ce9aaa9804bcfed8ded90fa18b

                                            SHA256

                                            bf752b93a64b0260d64ab06020d49af7894b9bcc40552acebbc6c1b984f196ac

                                            SHA512

                                            37c61964e0de284e3ed56362f9f933ad5863e9b136803cf02c2bcc545c00326c60797db76517f1290a672152235ea9537b31d8891eb5c409037ca916b7529fb1

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            0748eff8a87fcd1207c40ae1a74b0d0d

                                            SHA1

                                            a947ea73234b494ff33af8ba25a20a24eb44abd3

                                            SHA256

                                            64fc214fad2e9c06e80eecc9004f4da31617d633b123550a816b8c1a92fc4fa5

                                            SHA512

                                            84941b934e23b4c451d6098e80a48397b361695afa419a8e76c12430f8b2485cf3a396990080e4a2706e121af13b2ecbca92dc4232d59d65e4af776ef999efb5

                                          • C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat

                                            Filesize

                                            215B

                                            MD5

                                            c3fb76e4e8620175909b3baf548a8770

                                            SHA1

                                            0ebb9325363ec46bae8d4d185c2e69e90a6d4ea2

                                            SHA256

                                            7ac448307d1b9e353e755f5b0686452a780ef6f65e6ca993217e974cd26f8a0d

                                            SHA512

                                            fbfdbcd5463052f53c4f1f2a5556c0a07e51ef3ded0de9c6c1d45fc9a3e4e9fa644df3857c289e270455f9f65db555c346c3150d6632fb0dad2b924104829ffb

                                          • C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat

                                            Filesize

                                            215B

                                            MD5

                                            0fcbd4b406e24bbf3a4fd686d7a91c56

                                            SHA1

                                            4e7026c723c5a3ae6b4b5c9cd8ed2c29f923ae3a

                                            SHA256

                                            a11abdfe14b1c6c4c482a592a3728fdff0a15c1bcd5f4d94ca08c025a30ac6c8

                                            SHA512

                                            cec17bb43395ee10a8524db439cfae7c2a373365da99252e5e3775320a977228ac143394bd3f27bbf7dd62d7f000469d5fc3c629aedad4178c7608db91dbe887

                                          • C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat

                                            Filesize

                                            215B

                                            MD5

                                            93295bcd27593b4f10c31c0f358f00da

                                            SHA1

                                            627deb44075914807e5d8c76c90b88bee1ebdeb0

                                            SHA256

                                            dc5b1da17db479fc9676341503ffdb21e100fd0c4fcd4900feb051942e631d7c

                                            SHA512

                                            d59c2379677046848511c10368d05bebb0e1db85b51193782a1de5cd5eb6742964ac640207cc47b6559ebbfd27485a000b534c3e40df31fda3bb53159b642d5a

                                          • C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat

                                            Filesize

                                            215B

                                            MD5

                                            9f529f07e71bce9041cee673de3e7e27

                                            SHA1

                                            96b5583b61265ef302c65d4e4703b457bd47ff31

                                            SHA256

                                            cb9c8e2bfbfa07192e3af5be6bdb3caa723e857c67259d67b81df9d94097c2fa

                                            SHA512

                                            648992788ea8a1629467c8cdfc6cd6f0af5ae0f21e470b5fd1302a86b2115bd466b54bc0ba44599fa95a28170787731d9e64615575c9398d59ddfc110da22b0f

                                          • C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat

                                            Filesize

                                            215B

                                            MD5

                                            9db1fd741b220d8484d4c4e7fa7621c3

                                            SHA1

                                            789eb82d1fc1e754077d78657b29cc3b9dcf0ca6

                                            SHA256

                                            954a52c5aa70f731266a421355e011e90efc48ed51448be42e2fbcae57d72da3

                                            SHA512

                                            59dae5412ee431e640dc3e9c2918bc5e76f54634d93ccdfffad59decdece4c057ec34e167fce6b161179e3bdc64769008f9c77224b85e8729e60afbe68581479

                                          • C:\Users\Admin\AppData\Local\Temp\Z9h9y3ccMK.bat

                                            Filesize

                                            215B

                                            MD5

                                            e59d5d87c8a54c9d66e82732122bad42

                                            SHA1

                                            1fea5755752ca4ef6527a48724cc1e169000dd45

                                            SHA256

                                            00d9cabebf47bc37f06b28c3b35b458ab4d9152213a62e94d0392d2128b4f2b5

                                            SHA512

                                            9c8cfc40712cb5d6a82e1c2c84d75784be483e11dddc38370d1b90c86ccb8c50c0b06b2a2e7304f6b12196a57751189a7ffb401518717b21d44c4c86cec395c5

                                          • C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat

                                            Filesize

                                            215B

                                            MD5

                                            a9403125cdc21a29da31a23430f246ab

                                            SHA1

                                            9899d079d7f0b523c77e6aa94968922e0f40d489

                                            SHA256

                                            3c0f7cd873f4c8f959906b732c3dd5530f81bf7c34c4ce443828aecb5a2fa73a

                                            SHA512

                                            d8502f98cd1a46fdd6a1406583236e381eece9784006e2c5678cd19f1a6c246f4f3ac15ade8f4faac8b2fbde55a6e4f68c8604ebf2b1b439251012f9fc2304e7

                                          • C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat

                                            Filesize

                                            215B

                                            MD5

                                            8dde08021485d6d727610cdb176b0811

                                            SHA1

                                            36c021e8844eb92c14c1b291bc22ff8069ffe89f

                                            SHA256

                                            f3da3615a836f3dccc5e7edafa46aec6250797abb9b0b2c4b4c43921e6f2b0fc

                                            SHA512

                                            abfba268509a54ea8bab6739c76e131e7af1d7081bbae580550e0be7fb887dc06b3a2e5f91b4f4f7f4dd5d29d277a3f8fc5e3330f0818005705ab3d4baa0aa7f

                                          • C:\Users\Admin\AppData\Local\Temp\hc9iMPvVJ4.bat

                                            Filesize

                                            215B

                                            MD5

                                            8540f444d73df93df958358a60e1db03

                                            SHA1

                                            672575d572f6f4b4bb77035d375f8d91351e2d63

                                            SHA256

                                            4fae9cf7e8aeb0f226d215a70ad80530027acd056f70c80d0cdfa24b18ada28b

                                            SHA512

                                            0188af174939a88d1c76459fbffb33651da8dfcabedabb6d9ada744d9102a579c742dd3baaeff931940e1d04fd3c7a1e459ba9d0a1344447c0347e421c7db61b

                                          • C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat

                                            Filesize

                                            215B

                                            MD5

                                            02724f656df3cab24a1ec0e93d0cdefe

                                            SHA1

                                            f79f4e4e6efe60afde25acd0e36ed723952a79f6

                                            SHA256

                                            4d0d7235364aa71b9cf579a190a942fe450d0b112dd08ea94a333631733e7a24

                                            SHA512

                                            ef2cac8a5b0589b07d1c2291df94b64783b9759760885ae290b30a7e130335713d13c26323ad3a0038d12d58b2be802897d52476e6ba7f7cab05817bad9ad348

                                          • C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat

                                            Filesize

                                            215B

                                            MD5

                                            27ce9259f6dd5054613a83f8f846f525

                                            SHA1

                                            5a4d46fc3ff55b70bafefd2dbbfc40b977440048

                                            SHA256

                                            63ab0e2bcbbbcbfe58517915b5a4e6036dcdb52d0f19ffae8d39dc0b27e59997

                                            SHA512

                                            c2919cd88e80a820286aa556de3ea806ada12bd8e785a5533090636fc70259940411f855750eeb2d9ff528d43181e28fde4b04fb10fb9126b259e4c1c11d8a50

                                          • C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat

                                            Filesize

                                            215B

                                            MD5

                                            2643e0ea6b3c9f8e01f3bf1512d0c8c4

                                            SHA1

                                            5b9f4ec3ac5b78355220c095ce8ffb7b9810b5f0

                                            SHA256

                                            9d911aa94ae1645e96b8f62014f9c44f2e4a9fe3f9c5d7af05dbc9a23dc75b6b

                                            SHA512

                                            f1e785fe747eacf0435c0a792425d610b60e32807ef515e21779de269ff86ed3a20edbbd070733029ead779368a19c7de04771d16c940c624bca14a0293e1769

                                          • C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat

                                            Filesize

                                            215B

                                            MD5

                                            2643e0ea6b3c9f8e01f3bf1512d0c8c4

                                            SHA1

                                            5b9f4ec3ac5b78355220c095ce8ffb7b9810b5f0

                                            SHA256

                                            9d911aa94ae1645e96b8f62014f9c44f2e4a9fe3f9c5d7af05dbc9a23dc75b6b

                                            SHA512

                                            f1e785fe747eacf0435c0a792425d610b60e32807ef515e21779de269ff86ed3a20edbbd070733029ead779368a19c7de04771d16c940c624bca14a0293e1769

                                          • C:\providercommon\1zu9dW.bat

                                            Filesize

                                            36B

                                            MD5

                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                            SHA1

                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                            SHA256

                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                            SHA512

                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                          • C:\providercommon\DllCommonsvc.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\providercommon\DllCommonsvc.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                            Filesize

                                            197B

                                            MD5

                                            8088241160261560a02c84025d107592

                                            SHA1

                                            083121f7027557570994c9fc211df61730455bb5

                                            SHA256

                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                            SHA512

                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                          • memory/60-749-0x0000000000A40000-0x0000000000A52000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1392-765-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1708-285-0x00000000016C0000-0x00000000016CC000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1708-286-0x000000001B960000-0x000000001B96C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1708-284-0x000000001B950000-0x000000001B95C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1708-283-0x0000000001610000-0x0000000001622000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1708-282-0x0000000000DF0000-0x0000000000F00000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2700-132-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-161-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-175-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-174-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-173-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-178-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-127-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-172-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-121-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-171-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-176-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-167-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-119-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-118-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-179-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-169-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-170-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-122-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-152-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-168-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-117-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-166-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-165-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-124-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-164-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-139-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-142-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-163-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-147-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-153-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-156-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-162-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-160-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-126-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-116-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-125-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-158-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-159-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-129-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-157-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-138-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-128-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-155-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-131-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-154-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-130-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-140-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-151-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-134-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-177-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-135-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-150-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-136-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-148-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-149-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-141-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-146-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-145-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-137-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-144-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-133-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2700-143-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/2740-732-0x0000000001520000-0x0000000001532000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/3560-726-0x00000000005F0000-0x0000000000602000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/3928-348-0x0000019D19D90000-0x0000019D19E06000-memory.dmp

                                            Filesize

                                            472KB

                                          • memory/3928-343-0x0000019D19A90000-0x0000019D19AB2000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/4404-674-0x00000000006C0000-0x00000000006D2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/5004-182-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/5004-181-0x0000000077840000-0x00000000779CE000-memory.dmp

                                            Filesize

                                            1.6MB

                                          • memory/5060-738-0x0000000000B90000-0x0000000000BA2000-memory.dmp

                                            Filesize

                                            72KB