Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 11:40

General

  • Target

    0726a1ba5835a80a73e7a82de6cf5b3a29110c608fa8580c94c6237a9e7a3a7c.exe

  • Size

    1.3MB

  • MD5

    c91d808b87c8fa7c08986f449d555b76

  • SHA1

    6a185f70f0bd5cf81202199a8d749956732df988

  • SHA256

    0726a1ba5835a80a73e7a82de6cf5b3a29110c608fa8580c94c6237a9e7a3a7c

  • SHA512

    ec2ffca632e247652ad8ffd8f26943d12076ffd7fcf3a2afd5cd3c0b1182904cfc63f06fef0bc7eeb2cd918a17d0c16b5bbb146567cd855b9e2bb1ae1b2349d0

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 13 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 10 IoCs
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0726a1ba5835a80a73e7a82de6cf5b3a29110c608fa8580c94c6237a9e7a3a7c.exe
    "C:\Users\Admin\AppData\Local\Temp\0726a1ba5835a80a73e7a82de6cf5b3a29110c608fa8580c94c6237a9e7a3a7c.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:988
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4992
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:792
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\taskhostw.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2476
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2008
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:372
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4088
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\services.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3068
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\SHARED\WmiPrvSE.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3100
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2592
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\Registry.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1436
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1788
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2492
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\fontdrvhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3892
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3836
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\taskhostw.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3672
          • C:\odt\wininit.exe
            "C:\odt\wininit.exe"
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4760
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:6120
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2388
                • C:\odt\wininit.exe
                  "C:\odt\wininit.exe"
                  7⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3516
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5652
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:1380
                      • C:\odt\wininit.exe
                        "C:\odt\wininit.exe"
                        9⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3648
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:672
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:3492
                            • C:\odt\wininit.exe
                              "C:\odt\wininit.exe"
                              11⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5484
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F1gdtReUkn.bat"
                                12⤵
                                  PID:5704
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    13⤵
                                      PID:5444
                                    • C:\odt\wininit.exe
                                      "C:\odt\wininit.exe"
                                      13⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1960
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eUivgxqvfs.bat"
                                        14⤵
                                          PID:1324
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            15⤵
                                              PID:204
                                            • C:\odt\wininit.exe
                                              "C:\odt\wininit.exe"
                                              15⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4932
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sPXGbYzrvf.bat"
                                                16⤵
                                                  PID:8
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    17⤵
                                                      PID:3932
                                                    • C:\odt\wininit.exe
                                                      "C:\odt\wininit.exe"
                                                      17⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3964
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat"
                                                        18⤵
                                                          PID:5768
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            19⤵
                                                              PID:5508
                                                            • C:\odt\wininit.exe
                                                              "C:\odt\wininit.exe"
                                                              19⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4116
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat"
                                                                20⤵
                                                                  PID:1464
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    21⤵
                                                                      PID:804
                                                                    • C:\odt\wininit.exe
                                                                      "C:\odt\wininit.exe"
                                                                      21⤵
                                                                      • Executes dropped EXE
                                                                      • Checks computer location settings
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1684
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uLZJId2lFR.bat"
                                                                        22⤵
                                                                          PID:4608
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            23⤵
                                                                              PID:5872
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\fr-FR\taskhostw.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2596
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\taskhostw.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2492
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\fr-FR\taskhostw.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4516
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Application Data\conhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:5060
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4856
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1544
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1876
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4480
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2036
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\odt\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3180
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4532
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4704
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\providercommon\winlogon.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2052
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1972
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3348
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\odt\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:756
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3640
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4848
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\AppReadiness\services.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1048
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppReadiness\services.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3168
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\AppReadiness\services.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4172
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4348
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:448
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:948
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\SHARED\WmiPrvSE.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2808
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\WmiPrvSE.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3060
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\InputMethod\SHARED\WmiPrvSE.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4428
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\Registry.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2188
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Music\Registry.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3152
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\Registry.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4504
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\providercommon\upfc.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1564
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2304
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2284
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3992
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1736
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4732
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\providercommon\SppExtComObj.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3744
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1072
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4508
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3764
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4032
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1820
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\fontdrvhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1612
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4772
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:828
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\odt\conhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4160
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3560
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:800
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3368
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2392
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4768
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\odt\taskhostw.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4568
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4456
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4500

                                Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        17fbfbe3f04595e251287a6bfcdc35de

                                        SHA1

                                        b576aabfd5e6d5799d487011506ed1ae70688987

                                        SHA256

                                        2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

                                        SHA512

                                        449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        17fbfbe3f04595e251287a6bfcdc35de

                                        SHA1

                                        b576aabfd5e6d5799d487011506ed1ae70688987

                                        SHA256

                                        2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

                                        SHA512

                                        449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        17fbfbe3f04595e251287a6bfcdc35de

                                        SHA1

                                        b576aabfd5e6d5799d487011506ed1ae70688987

                                        SHA256

                                        2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

                                        SHA512

                                        449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        17fbfbe3f04595e251287a6bfcdc35de

                                        SHA1

                                        b576aabfd5e6d5799d487011506ed1ae70688987

                                        SHA256

                                        2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

                                        SHA512

                                        449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        9c97a801bb5d6c21c265ab7f283ba83e

                                        SHA1

                                        7c0a4cb73d63702a2d454268d983e0dcb36a8bf8

                                        SHA256

                                        69d9676a8c93686c904d9ce6193221476d6c72bc4d3250a232c03ccbeae380c7

                                        SHA512

                                        d3abd8bfccd3a3fec55c13e85e755fbd589e6ea04321169c7c8cf5badf7b6ffe96c0c2ed449a0b4a99ecfd1e7bb7edc3311d335c8956cf344c9584fb0bda50d9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        9c97a801bb5d6c21c265ab7f283ba83e

                                        SHA1

                                        7c0a4cb73d63702a2d454268d983e0dcb36a8bf8

                                        SHA256

                                        69d9676a8c93686c904d9ce6193221476d6c72bc4d3250a232c03ccbeae380c7

                                        SHA512

                                        d3abd8bfccd3a3fec55c13e85e755fbd589e6ea04321169c7c8cf5badf7b6ffe96c0c2ed449a0b4a99ecfd1e7bb7edc3311d335c8956cf344c9584fb0bda50d9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        61e06aa7c42c7b2a752516bcbb242cc1

                                        SHA1

                                        02c54f8b171ef48cad21819c20b360448418a068

                                        SHA256

                                        5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

                                        SHA512

                                        03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        e8ce785f8ccc6d202d56fefc59764945

                                        SHA1

                                        ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                        SHA256

                                        d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                        SHA512

                                        66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        e8ce785f8ccc6d202d56fefc59764945

                                        SHA1

                                        ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                        SHA256

                                        d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                        SHA512

                                        66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        61e06aa7c42c7b2a752516bcbb242cc1

                                        SHA1

                                        02c54f8b171ef48cad21819c20b360448418a068

                                        SHA256

                                        5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

                                        SHA512

                                        03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        e8ce785f8ccc6d202d56fefc59764945

                                        SHA1

                                        ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                        SHA256

                                        d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                        SHA512

                                        66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        ecceac16628651c18879d836acfcb062

                                        SHA1

                                        420502b3e5220a01586c59504e94aa1ee11982c9

                                        SHA256

                                        58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                        SHA512

                                        be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        ecceac16628651c18879d836acfcb062

                                        SHA1

                                        420502b3e5220a01586c59504e94aa1ee11982c9

                                        SHA256

                                        58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                        SHA512

                                        be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        5f0ddc7f3691c81ee14d17b419ba220d

                                        SHA1

                                        f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                        SHA256

                                        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                        SHA512

                                        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        5f0ddc7f3691c81ee14d17b419ba220d

                                        SHA1

                                        f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                        SHA256

                                        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                        SHA512

                                        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        5f0ddc7f3691c81ee14d17b419ba220d

                                        SHA1

                                        f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                        SHA256

                                        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                        SHA512

                                        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        aaaac7c68d2b7997ed502c26fd9f65c2

                                        SHA1

                                        7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                        SHA256

                                        8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                        SHA512

                                        c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        aaaac7c68d2b7997ed502c26fd9f65c2

                                        SHA1

                                        7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                        SHA256

                                        8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                        SHA512

                                        c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                      • C:\Users\Admin\AppData\Local\Temp\F1gdtReUkn.bat

                                        Filesize

                                        183B

                                        MD5

                                        e02867702c56151d5147d6ba944432c9

                                        SHA1

                                        e0a9b2043fd75145522663f6c749fd2ac656c1c3

                                        SHA256

                                        fc7ca8e0b0a7761076261ec30294f4cb72db8e3a13fb8ea1a4a375fb0a82ab2d

                                        SHA512

                                        1c787a7c0256f0a6f180df1655a3568d23db6a6c475154bec7024097773401d2a98f0fb2f2b7bda9f436fdff5d2127f4977b77b727fc929076bcde9f72c779b1

                                      • C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat

                                        Filesize

                                        183B

                                        MD5

                                        5d8805f520d62fa8aaf6030079d68f60

                                        SHA1

                                        85a5f0fbf5b1a89e65b4d18f8318ae2d26768033

                                        SHA256

                                        b8511feda08bd6d87dfc60057d940be45ad8311ab3cfefc479a55e36bf853b31

                                        SHA512

                                        b8f52044bca921faf76cc1ce4016ac8da9a880c04288aae48966692e8e20f5515e213d1ab69282aeaf889c84042468220df92be7148d1d00ccc3f2fe39294bdb

                                      • C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

                                        Filesize

                                        183B

                                        MD5

                                        6c5a99750c6831635c5432e92d8a0be9

                                        SHA1

                                        5a2ed813bb704adeeac548ae6a14989880075479

                                        SHA256

                                        7cebc602577ae37f0279dc502baa6855a08ccb2e4d5819f4ef4e65996db0d3aa

                                        SHA512

                                        fc0a453aa0b475d0d8b2111d9f0978b755d64c7dbe1c712b8249207217a786a4aa2be0bdc305978361a419c7488967c75eaecfb85dadbe6685d50d9f97b1a692

                                      • C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat

                                        Filesize

                                        183B

                                        MD5

                                        3c0d1bd8d0471371f8e24fabe228f462

                                        SHA1

                                        7ce630b2176c838b1567d48640f3497a3d85300a

                                        SHA256

                                        0b9a50b46f1c7e8af6025ded549928eefb2ea4fa3cd57987f974a855452381ef

                                        SHA512

                                        3533b87aa3ce44f50d0790c74260fb35163957c26846c2638b099498577ca3d60dc37e09f2f2d11072b457f392666e22ca3384077e6d72806efb2983651df29c

                                      • C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat

                                        Filesize

                                        183B

                                        MD5

                                        9ec42c8532c00334f6bd03f9bf12af0f

                                        SHA1

                                        8846dc754ab2ea2c210e965c3ed7543530bf97e5

                                        SHA256

                                        f824907c40b151923da693dc8fe33d492fbfcb7bef7d97623c30ace59a5a5e6e

                                        SHA512

                                        a67e4a51341fdd5eedc5793d545d22951ed69d38658f622a74e6eac79624cfcf18d98f108a26807b3bfffab1ee94ad1896fd12b92a7fbaa16dcda05bd1cb6592

                                      • C:\Users\Admin\AppData\Local\Temp\sPXGbYzrvf.bat

                                        Filesize

                                        183B

                                        MD5

                                        3df2139395d681172129dc342c4f1106

                                        SHA1

                                        29226d099cb63843f007f69a9f319a0a73ae3088

                                        SHA256

                                        e73a7ee96cafc2294e9ae75eb325f4d8a7acf4c188fe59723d4bff1fae9e882d

                                        SHA512

                                        9eee1c463b4349ffcbf47b2d6e19d17153364199820f94aa9bce09cb250f840e1b665ed8c8dbaf8d619c674c4d74fdc638d14df699f35c0e9232708021b446b5

                                      • C:\Users\Admin\AppData\Local\Temp\uLZJId2lFR.bat

                                        Filesize

                                        183B

                                        MD5

                                        3b062e9b12a0fe5c8bb66803243c6648

                                        SHA1

                                        19fce0443be3775ddf819031445c6f542e9c93b1

                                        SHA256

                                        a6cdf6863c949c270cd4e12c44cb87a1c4e90ed9a12aa89f168b5b3ceb25867b

                                        SHA512

                                        47a1a7297933db3afdd64c0ce27a7ae9695beb17616f5f2c1948b94d3a80f1ddc65028d057501472e951b31080afee98d56e631124e932b3ef6b8d052b9d53f3

                                      • C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat

                                        Filesize

                                        183B

                                        MD5

                                        b082fc590652aedf587049c33bd1c50c

                                        SHA1

                                        c723616fd45f18b9810dc8b6cfe32ab871772960

                                        SHA256

                                        0bcac4f3175f15d6d9072bf671b7fddc2a9d1e06f98a0ad3f1c698043ccf06b9

                                        SHA512

                                        344cdf761a0988d50099d85ca83b7e788d46a76d16fbff9301088dfc1770d0700b8363cb3f9c8753b2fb33f81094130d84036b52cf3feb0841b6585b8264bccf

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\odt\wininit.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/372-194-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/372-163-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1436-177-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1436-208-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1684-280-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1684-276-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1788-213-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1788-178-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1960-253-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1960-251-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2008-196-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2008-162-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2476-161-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2476-158-0x0000023F9A1F0000-0x0000023F9A212000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/2476-195-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2492-219-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2492-181-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2592-206-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/2592-173-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3068-198-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3068-168-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3100-202-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3100-174-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3460-193-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3460-167-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3516-232-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3516-230-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3648-241-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3648-237-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3672-221-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3672-184-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3836-225-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3836-183-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3892-215-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3892-179-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3964-262-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3964-266-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4088-200-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4088-171-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4116-269-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4116-273-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4208-176-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4208-212-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4340-205-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4340-172-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4400-169-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4400-139-0x0000000000E70000-0x0000000000F80000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/4400-140-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4464-201-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4464-170-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4704-218-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4704-182-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4760-226-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4760-180-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4852-207-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4852-175-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4932-259-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4932-255-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/5484-248-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/5484-244-0x00007FFDDFE90000-0x00007FFDE0951000-memory.dmp

                                        Filesize

                                        10.8MB