Analysis

  • max time kernel
    141s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 10:39

General

  • Target

    4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe

  • Size

    1.3MB

  • MD5

    36bd1f729c2d22d40437d7dfaf00e34b

  • SHA1

    3463ce26689fc9cc7e20a744dc333afaf5c1ef59

  • SHA256

    4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30

  • SHA512

    67c4ab1ba266993de5596ae5321a6a2b55cadf792c136935efd90cc153883e41a3982e719aeab1176e7a57aa4c3be41880e55f87d6e78b81427126771c653d65

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 14 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 11 IoCs
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe
    "C:\Users\Admin\AppData\Local\Temp\4c95baeb517bf5578a2c90d624727134ac2f8aeed7b032821dd564937926fe30.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4744
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3956
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4808
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4048
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2316
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\cmd.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\fontdrvhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1632
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3748
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1120
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4584
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4692
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2292
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5104
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j9zErPDE6Z.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:5748
              • C:\Users\Admin\conhost.exe
                "C:\Users\Admin\conhost.exe"
                6⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3864
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5300
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2240
                    • C:\Users\Admin\conhost.exe
                      "C:\Users\Admin\conhost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:728
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:924
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:5804
                          • C:\Users\Admin\conhost.exe
                            "C:\Users\Admin\conhost.exe"
                            10⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3976
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5892
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:5464
                                • C:\Users\Admin\conhost.exe
                                  "C:\Users\Admin\conhost.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3424
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"
                                    13⤵
                                      PID:5936
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        14⤵
                                          PID:3788
                                        • C:\Users\Admin\conhost.exe
                                          "C:\Users\Admin\conhost.exe"
                                          14⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1536
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat"
                                            15⤵
                                              PID:5960
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                16⤵
                                                  PID:1336
                                                • C:\Users\Admin\conhost.exe
                                                  "C:\Users\Admin\conhost.exe"
                                                  16⤵
                                                  • Executes dropped EXE
                                                  • Checks computer location settings
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5524
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"
                                                    17⤵
                                                      PID:1836
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        18⤵
                                                          PID:4432
                                                        • C:\Users\Admin\conhost.exe
                                                          "C:\Users\Admin\conhost.exe"
                                                          18⤵
                                                          • Executes dropped EXE
                                                          • Checks computer location settings
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4444
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"
                                                            19⤵
                                                              PID:5692
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                20⤵
                                                                  PID:3048
                                                                • C:\Users\Admin\conhost.exe
                                                                  "C:\Users\Admin\conhost.exe"
                                                                  20⤵
                                                                  • Executes dropped EXE
                                                                  • Checks computer location settings
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5744
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"
                                                                    21⤵
                                                                      PID:3492
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        22⤵
                                                                          PID:4048
                                                                        • C:\Users\Admin\conhost.exe
                                                                          "C:\Users\Admin\conhost.exe"
                                                                          22⤵
                                                                          • Executes dropped EXE
                                                                          • Checks computer location settings
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:796
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"
                                                                            23⤵
                                                                              PID:3548
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                24⤵
                                                                                  PID:3216
                                                                                • C:\Users\Admin\conhost.exe
                                                                                  "C:\Users\Admin\conhost.exe"
                                                                                  24⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4544
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2340
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1096
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1120
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3960
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4536
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sihost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4856
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3908
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:5112
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4504
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\cmd.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4528
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Music\cmd.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4320
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\cmd.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4476
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4560
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2152
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2352
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1348
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2716
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2232
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4188
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4360
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1972
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1792
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3624
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4608
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\providercommon\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1876
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4716
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4972
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2644
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1088
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1280
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1796
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1556
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\winlogon.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3492
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\odt\dwm.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2664
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3472
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3208
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\odt\dwm.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4572
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2608
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3016
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\providercommon\upfc.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3236
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1092
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1536
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1256
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4324
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3836
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:484
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4192
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:5052

                                  Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                          Filesize

                                          1KB

                                          MD5

                                          baf55b95da4a601229647f25dad12878

                                          SHA1

                                          abc16954ebfd213733c4493fc1910164d825cac8

                                          SHA256

                                          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                          SHA512

                                          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          ecceac16628651c18879d836acfcb062

                                          SHA1

                                          420502b3e5220a01586c59504e94aa1ee11982c9

                                          SHA256

                                          58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                          SHA512

                                          be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          ecceac16628651c18879d836acfcb062

                                          SHA1

                                          420502b3e5220a01586c59504e94aa1ee11982c9

                                          SHA256

                                          58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                          SHA512

                                          be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          e8ce785f8ccc6d202d56fefc59764945

                                          SHA1

                                          ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                          SHA256

                                          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                          SHA512

                                          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          e8ce785f8ccc6d202d56fefc59764945

                                          SHA1

                                          ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                          SHA256

                                          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                          SHA512

                                          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          377c375f814a335a131901ed5d5eca44

                                          SHA1

                                          9919811b18b4f8153541b332232ae88eec42f9f7

                                          SHA256

                                          7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10

                                          SHA512

                                          c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          377c375f814a335a131901ed5d5eca44

                                          SHA1

                                          9919811b18b4f8153541b332232ae88eec42f9f7

                                          SHA256

                                          7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10

                                          SHA512

                                          c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          377c375f814a335a131901ed5d5eca44

                                          SHA1

                                          9919811b18b4f8153541b332232ae88eec42f9f7

                                          SHA256

                                          7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10

                                          SHA512

                                          c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          377c375f814a335a131901ed5d5eca44

                                          SHA1

                                          9919811b18b4f8153541b332232ae88eec42f9f7

                                          SHA256

                                          7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10

                                          SHA512

                                          c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          377c375f814a335a131901ed5d5eca44

                                          SHA1

                                          9919811b18b4f8153541b332232ae88eec42f9f7

                                          SHA256

                                          7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10

                                          SHA512

                                          c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          377c375f814a335a131901ed5d5eca44

                                          SHA1

                                          9919811b18b4f8153541b332232ae88eec42f9f7

                                          SHA256

                                          7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10

                                          SHA512

                                          c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          5f0ddc7f3691c81ee14d17b419ba220d

                                          SHA1

                                          f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                          SHA256

                                          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                          SHA512

                                          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          101c3b86ef1c02c62b7d862c2a47363b

                                          SHA1

                                          3c5e8d309610e5ba41b6b9788bfb826e45864b46

                                          SHA256

                                          9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

                                          SHA512

                                          d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          e8ce785f8ccc6d202d56fefc59764945

                                          SHA1

                                          ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                          SHA256

                                          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                          SHA512

                                          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          e8ce785f8ccc6d202d56fefc59764945

                                          SHA1

                                          ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                          SHA256

                                          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                          SHA512

                                          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          e8ce785f8ccc6d202d56fefc59764945

                                          SHA1

                                          ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                          SHA256

                                          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                          SHA512

                                          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Filesize

                                          944B

                                          MD5

                                          60804e808a88131a5452fed692914a8e

                                          SHA1

                                          fdb74669923b31d573787fe024dbd701fa21bb5b

                                          SHA256

                                          064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

                                          SHA512

                                          d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

                                        • C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat

                                          Filesize

                                          191B

                                          MD5

                                          ab933e27aee52c88e76189bf925b1659

                                          SHA1

                                          8a707ffcd67bec64f8c0ddaf5a4056c872a107c2

                                          SHA256

                                          3368ae6c1f5f87a3aca1595133d31623c72742a4ada55ce5d44c0934f42d76e8

                                          SHA512

                                          db5f452c941e1d24db3dab20674f0606cbedf8d669e47c4be56284e5e60a9b21f44f94152c81eb15ee053dd05de5398df1ab401994c00a5201e0337b8248dcfd

                                        • C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat

                                          Filesize

                                          191B

                                          MD5

                                          1b326ea76a566e8cea6d2befb691fa66

                                          SHA1

                                          dca2f9837f85ef2d868e6441187960ceef85c2bd

                                          SHA256

                                          428be1a2fe6ff4d0a34d50621c3a4854a4b1058553b80ba8da85bba8bb413ef7

                                          SHA512

                                          0ab9e4e9b4f768a42c6479359bc56ceeca40e08deaf2e6358fe426041574af9d79b0b3d4cea0bc7e1a16c92f573486f04bd1fe1ca294b7a702f0e556eea04abc

                                        • C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat

                                          Filesize

                                          191B

                                          MD5

                                          40c5b9fd27efcedb204af88bf549a55e

                                          SHA1

                                          607611b3b6f1a95edc4104773689dd81e4b985f9

                                          SHA256

                                          55242d4433be0079c3a6987ef98e18536cb8d432f8f1596225b8aba544e28d1a

                                          SHA512

                                          4ee526b31a129dbc098a2f972fd519f57e1d5499176b570d5ed5f5004e1ae9509a28f65e5c241e25a2311560467ecfd784f9c81f6fce384e1af8290e421f831d

                                        • C:\Users\Admin\AppData\Local\Temp\4yKdveU0JJ.bat

                                          Filesize

                                          191B

                                          MD5

                                          ffea17289c28c3d1d5d2baa0b1f6f0c7

                                          SHA1

                                          645b8c9724df56515e361d6b4602d5d5bb5bc607

                                          SHA256

                                          c1594482676fecc464121d0b15ba691823ea554b278a519dbcc978778a29849f

                                          SHA512

                                          a35d9b6ead7dbf7a4d2193bf902c5520134fbf5079c9fc00f9e5d8a0143a9753e35e386bd64fe89ec44642ac01742a7a66f17963c2178ebb36168f759ea61fa8

                                        • C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat

                                          Filesize

                                          191B

                                          MD5

                                          a747dbb305a57a8cc4452e3f1817db70

                                          SHA1

                                          39a2685021ec1dc27d0726e0c0fca6cf6f5689e8

                                          SHA256

                                          b91b113309583c0390c6f810633dd062a2f6ef93a6a328cd5c131af0f2538b2f

                                          SHA512

                                          35130831fe00c52dbc275ea36163deaa2eecb06e1be048e43a54d823d5b022e0d78f9919e36428d4b6764bf9f20c1fcd6a0960e15fae9433523d7f060d722ada

                                        • C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat

                                          Filesize

                                          191B

                                          MD5

                                          9c4641acd8afa3736e25d29060a49f0f

                                          SHA1

                                          ae9fa82fd25d72577ee5b9b7d31664e646e0ef0a

                                          SHA256

                                          8ffcdea4c237f4625ed3f73d34775e8e6341ec3aa7f585f121e582893c2d54f2

                                          SHA512

                                          197fff557c5095240ba461499e9317a40139118b80c8b1c4b97de68ac3653ec0b4d866c49efffcf1937dc26c087e85be5cf4855a57b2d1cf6f242eceec458ae2

                                        • C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat

                                          Filesize

                                          191B

                                          MD5

                                          931307b39e6e038fc80af43400160656

                                          SHA1

                                          fb814c5a2fe2faf97bc99696064228cac06be1f5

                                          SHA256

                                          41f6914bc7279a224099fdda87366f068931c3ef5ab7f144f010f8a02bfaf3ad

                                          SHA512

                                          d23fb2d60f675208e6dc41c1175cccd115fb98254d3a2594ccac40e00ef0dd4c3ec9c2d12539afe4a6cf97d4c1fd7632cd459524dc99bf2ab0a0eb71896e9e88

                                        • C:\Users\Admin\AppData\Local\Temp\j9zErPDE6Z.bat

                                          Filesize

                                          191B

                                          MD5

                                          2b426971763b8f4c3d4d4a37a1fc47fd

                                          SHA1

                                          2711b1b488e6963cee4e61fa1aeb99a046779058

                                          SHA256

                                          f5c0d93ad335266bb0e13eaa2064c793dff845767f129afb351e93b5c919ae4f

                                          SHA512

                                          f7649378819cd0283354f9270a6d39750a84da7b0cfe245bd881652b749822bc89e7d6953cc78fa4d9537b77a2ac5a66d92223903c00e5c95a357942afe4a39f

                                        • C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat

                                          Filesize

                                          191B

                                          MD5

                                          134890807e7c10d8d1fd64ca8410d6bb

                                          SHA1

                                          8d3f6d3c33f2e8ecc51147b333bd162456bcbbc3

                                          SHA256

                                          e438cd9330b01fc0dcfe4ffcff8c45436ff025305378fcd48db60a5455cad5f6

                                          SHA512

                                          f418f88b5ba4fdfee5299b5f601213f405e8d77b5c1a2928263d7d023e202401a4b6a0cce7f060dba52ac1b8cca4b08aefb9a5609a921adba1ff7fbd9557301c

                                        • C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat

                                          Filesize

                                          191B

                                          MD5

                                          134890807e7c10d8d1fd64ca8410d6bb

                                          SHA1

                                          8d3f6d3c33f2e8ecc51147b333bd162456bcbbc3

                                          SHA256

                                          e438cd9330b01fc0dcfe4ffcff8c45436ff025305378fcd48db60a5455cad5f6

                                          SHA512

                                          f418f88b5ba4fdfee5299b5f601213f405e8d77b5c1a2928263d7d023e202401a4b6a0cce7f060dba52ac1b8cca4b08aefb9a5609a921adba1ff7fbd9557301c

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\Users\Admin\conhost.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\providercommon\1zu9dW.bat

                                          Filesize

                                          36B

                                          MD5

                                          6783c3ee07c7d151ceac57f1f9c8bed7

                                          SHA1

                                          17468f98f95bf504cc1f83c49e49a78526b3ea03

                                          SHA256

                                          8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                          SHA512

                                          c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                        • C:\providercommon\DllCommonsvc.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\providercommon\DllCommonsvc.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                          Filesize

                                          197B

                                          MD5

                                          8088241160261560a02c84025d107592

                                          SHA1

                                          083121f7027557570994c9fc211df61730455bb5

                                          SHA256

                                          2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                          SHA512

                                          20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                        • memory/728-225-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/728-229-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/796-278-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/796-174-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/796-274-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/796-210-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1120-211-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1120-176-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1288-173-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1288-203-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1536-246-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1536-250-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1632-190-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/1632-168-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2292-170-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2292-208-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2316-162-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2316-185-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2832-164-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2832-201-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2916-166-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/2916-139-0x00000000002D0000-0x00000000003E0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2916-140-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3424-243-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3424-239-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3748-169-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3748-196-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3864-217-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3864-221-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3956-188-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3956-160-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3976-232-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/3976-236-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4004-199-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4004-167-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4048-187-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4048-158-0x0000028BD6110000-0x0000028BD6132000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/4048-161-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4444-263-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4444-260-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4544-281-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4584-178-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4584-198-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4692-213-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4692-171-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4712-175-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4712-207-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4808-184-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/4808-156-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5004-165-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5004-197-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5104-179-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5104-200-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5524-253-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5524-257-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5744-271-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB

                                        • memory/5744-267-0x00007FFC52A60000-0x00007FFC53521000-memory.dmp

                                          Filesize

                                          10.8MB