Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 08:32

General

  • Target

    6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe

  • Size

    1.3MB

  • MD5

    2ccbec0d52d71b3a44b1bb2b476a04dd

  • SHA1

    119fc4f2fde76f08afc8f4ee62357d4f46c85146

  • SHA256

    6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc

  • SHA512

    8c37e9958fab698a33b5af9ab6b672495376df1147812963de02f848b545baa8051f0fdf4b3f84cedfac873ae99ed3fb1b315928a015c6151c13ed11461605ee

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 16 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 13 IoCs
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe
    "C:\Users\Admin\AppData\Local\Temp\6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:420
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:664
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1788
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\winlogon.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1648
          • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
            "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1432
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4308
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3552
                • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                  "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                  7⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4072
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1380
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:4772
                      • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                        9⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4732
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4980
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:1328
                            • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                              "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                              11⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3796
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4616
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:3872
                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                    "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                    13⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:3412
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rn5V8mQYRH.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1436
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:3324
                                        • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                          "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                          15⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1944
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1376
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:428
                                              • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                                "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                                17⤵
                                                • Executes dropped EXE
                                                • Checks computer location settings
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4400
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
                                                  18⤵
                                                    PID:220
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:4780
                                                      • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                                        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                                        19⤵
                                                        • Executes dropped EXE
                                                        • Checks computer location settings
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4752
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat"
                                                          20⤵
                                                            PID:3836
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:4952
                                                              • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                                                "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                                                21⤵
                                                                • Executes dropped EXE
                                                                • Checks computer location settings
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4028
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat"
                                                                  22⤵
                                                                    PID:3576
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      23⤵
                                                                        PID:4800
                                                                      • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                                                        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                                                        23⤵
                                                                        • Executes dropped EXE
                                                                        • Checks computer location settings
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3056
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat"
                                                                          24⤵
                                                                            PID:1372
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:4444
                                                                              • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                                                                "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                                                                25⤵
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4772
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat"
                                                                                  26⤵
                                                                                    PID:1716
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      27⤵
                                                                                        PID:1092
                                                                                      • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
                                                                                        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
                                                                                        27⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2592
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3044
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2752
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4248
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1944
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:5076
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:504
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2588
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3920
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4004
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:116
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4024
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4020
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4032
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2504
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4256
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\odt\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4304
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4236
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3772
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\winlogon.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:740
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\winlogon.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4996
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\winlogon.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3840
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3576
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4372
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4800

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                    Filesize

                                    1KB

                                    MD5

                                    baf55b95da4a601229647f25dad12878

                                    SHA1

                                    abc16954ebfd213733c4493fc1910164d825cac8

                                    SHA256

                                    ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                    SHA512

                                    24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                    Filesize

                                    2KB

                                    MD5

                                    d85ba6ff808d9e5444a4b369f5bc2730

                                    SHA1

                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                    SHA256

                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                    SHA512

                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    aaaac7c68d2b7997ed502c26fd9f65c2

                                    SHA1

                                    7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                    SHA256

                                    8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                    SHA512

                                    c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    aaaac7c68d2b7997ed502c26fd9f65c2

                                    SHA1

                                    7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                    SHA256

                                    8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                    SHA512

                                    c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                  • C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat

                                    Filesize

                                    230B

                                    MD5

                                    021662fd811ece920590ad6312ac87bc

                                    SHA1

                                    a37f38cc1c5d9336c69cc5b0d87cb24703cd03f1

                                    SHA256

                                    146fe9fc8805500dfab3ed59c297999de9bc6205af1bc4a12c358245a4690fa9

                                    SHA512

                                    942b6559f84428f54426f1b88388e5e916822550cb33d8fd537adccbd44ac6196975202bb136b5fa0cd38ccc945f4429bfb6480cddb76bb3de14b6dd79529095

                                  • C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat

                                    Filesize

                                    230B

                                    MD5

                                    20bbbb1753c93b3a7f52f0814ca2d90c

                                    SHA1

                                    69d4dae2e9e6bd3f0b000071c183afd5c5442567

                                    SHA256

                                    24d4bdaf8cd6a4f2fa1a954ee1015b3f255a801b072eace4230ef75237798c29

                                    SHA512

                                    4f673898bf1cc4261bc77adfab070038bf35ce5fbde40460825d60939ccd8457d26db102fb9179ef32a2347706cdc82fb1987041b5a8d77f9f4b51817aaebfc3

                                  • C:\Users\Admin\AppData\Local\Temp\Rn5V8mQYRH.bat

                                    Filesize

                                    230B

                                    MD5

                                    021a846ca3f1c4d6f68a18934f8d4691

                                    SHA1

                                    708d28b25e6c994a42e0e4644b75274701f33c14

                                    SHA256

                                    a7509602d0af60566c732c5f2e1ed2bab3e5c4b94a759e659ce68e384247d06a

                                    SHA512

                                    2ff5732282840d37d818f785bdb5f6d017a87a708cc066d17f0a0fc6b5becd8008c9ea0d6344af403dd2e42147bfa972304b70ac4b81d996badaa38686988cdc

                                  • C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat

                                    Filesize

                                    230B

                                    MD5

                                    1ad529191b144fe94c675b5b5d0d7627

                                    SHA1

                                    f13d1097508162b73ed98780159586852fe3e9dc

                                    SHA256

                                    f8ee227dfe9f95c1fc26144ec997c2ee7fd408c57fab86cc37057f1cc3c058b5

                                    SHA512

                                    07a7458ce9c7d16e0d0b1043c4378e3c76cdd684fd23efb5976545e1e6f4d62b63a899f312626085fd56318a5a98bc4a9e84d1e1f5bbe37f0075b82d6c4c338d

                                  • C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat

                                    Filesize

                                    230B

                                    MD5

                                    cd730d14ff10646e0c0e391196a000dc

                                    SHA1

                                    e27bbb3b2c6c5384a47f316dc9a28d2fbd7d6cde

                                    SHA256

                                    66b3e4501dad2a55cfcc72dca689dd6c8a53ef73c5cd771fceddd2081bb3d37d

                                    SHA512

                                    dfe00e43e90a934d749c0d19be5cf71ddf2f956ed886289d3645e07a7edab945fe9578b87a206d43d9ec73d566759fce3178c2a98548a3cf11b124c2279716a9

                                  • C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat

                                    Filesize

                                    230B

                                    MD5

                                    b803cc4f238526b513bb876998cf6602

                                    SHA1

                                    3cc4de7a3446ce009fd829396f0a117d07a6fd0c

                                    SHA256

                                    f777a0942c56e7ba42e0d9b59a28ce8b9e14270826e975651637f2ad088b5d68

                                    SHA512

                                    51ec7b7566c41d36c50dfc7889228e47ebac44138f6133bd0212f0f82c7b17a8098036ecfb01fc693061b2a33a85d9a9da1871137ba0073218090ded0a8f1a8b

                                  • C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat

                                    Filesize

                                    230B

                                    MD5

                                    f327f8977918e5f89fcb7ddece9a5b81

                                    SHA1

                                    12cfa7f7f43c7800494bd623db3bff93ae216939

                                    SHA256

                                    198b9d1aae9cddc1325cf444455d550e13d9085b06d71c7719eade80d6c0d1ba

                                    SHA512

                                    301da87c46caab1da227a57138830290e447480e7731b64e270d7e63ea9327eaeeccadb9c23e089fdd5b9da64da5bd7dc871308b479f3b711b835be6e2a629f1

                                  • C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

                                    Filesize

                                    230B

                                    MD5

                                    3a12e9f00db248fb719627e2f5fd439c

                                    SHA1

                                    fc38738124e7cf6aa7f541816e8a89cdd768e4df

                                    SHA256

                                    153ff93fafa25f2662a35a002ee7542f3203f791fc8a1c5fd4dd534a204b97a1

                                    SHA512

                                    c7279c66ee4338a81d055b653a2b01d9592212eb43159ff1e741f6d0bacfd3440bb51b121eb1accc465208a448b4887ded4379ce040f2e9e2407cdbad50cd379

                                  • C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat

                                    Filesize

                                    230B

                                    MD5

                                    6f3e710e30d953f199cbbd03faa14c2b

                                    SHA1

                                    222cb02764521adca9718ec4ba7f5ca4d1cac204

                                    SHA256

                                    f2de9db3789462e76522805c66bae75be097795684ae3dae0b31879b68fe5089

                                    SHA512

                                    30285c06af5b8969ab5ffc48456873c21bbe616f120314436f7ef2d80f19c8ac9b6e6676e439924a38346f8b1d45a069388753066e882a8b8f515009c952a684

                                  • C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat

                                    Filesize

                                    230B

                                    MD5

                                    6da62cebb720db34af95b79259643a08

                                    SHA1

                                    24384d69d7659e821550a3960b0d0af31281a0b9

                                    SHA256

                                    cb382edc459dc06534e78c5071f374502af0fa22f7558ebc94b221e6f014d8ed

                                    SHA512

                                    ae71b4d3f879ace24115818aa9ef8f53ec11993f59c04210ba9d06d8742b9c1d0e9fc4a5d5e9191eb098b2ed7ccc1dd4ee6cbbbe6fc77128d3647757a52efc66

                                  • C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat

                                    Filesize

                                    230B

                                    MD5

                                    775a1c01ad828a28284c88b7e269c87e

                                    SHA1

                                    e919f8bedcf08bbcbeacde2eaec2caa77119eb0e

                                    SHA256

                                    999d338b2b1dd9d201fb07acf1488259e0f32c5f2aa92355850a7225172e07eb

                                    SHA512

                                    02568cd1bfb7c4ec306612ab4986993672b7e9cc86c3ba99b4eaa1e756913024c7f3bff153e3552f0776297c23699b891f1397ac35edf7f46fd09dac6abff1f2

                                  • C:\providercommon\1zu9dW.bat

                                    Filesize

                                    36B

                                    MD5

                                    6783c3ee07c7d151ceac57f1f9c8bed7

                                    SHA1

                                    17468f98f95bf504cc1f83c49e49a78526b3ea03

                                    SHA256

                                    8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                    SHA512

                                    c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                    Filesize

                                    197B

                                    MD5

                                    8088241160261560a02c84025d107592

                                    SHA1

                                    083121f7027557570994c9fc211df61730455bb5

                                    SHA256

                                    2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                    SHA512

                                    20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                  • memory/1400-139-0x00000000004C0000-0x00000000005D0000-memory.dmp

                                    Filesize

                                    1.1MB

                                  • memory/1400-140-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1400-155-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1432-161-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1432-186-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1648-160-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1648-178-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1700-182-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1700-162-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1788-173-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1788-163-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1852-167-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1852-156-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1944-222-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1944-218-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2592-260-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3056-250-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3056-246-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3200-158-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3200-174-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3412-215-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3412-211-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3428-159-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3428-175-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3448-154-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3448-177-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3796-204-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3796-208-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3952-164-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3952-180-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4028-243-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4028-239-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4072-190-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4072-192-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4400-229-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4400-225-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4732-197-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4732-201-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4752-232-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4752-236-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4772-253-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4772-257-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4872-176-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4872-157-0x00000236532D0000-0x00000236532F2000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/4872-150-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

                                    Filesize

                                    10.8MB