Analysis

  • max time kernel
    159s
  • max time network
    162s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/11/2022, 11:41

General

  • Target

    aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe

  • Size

    1.3MB

  • MD5

    12f338e54a19a37dfcf60b9271e8dcb1

  • SHA1

    b9e07ec838ed1b1454cdcf2f0493ce3a7a633085

  • SHA256

    aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1

  • SHA512

    969c43e5ef4e073f0ffc07524bfc292ab1a36ee012d0df92c89867d50be0c51234299470f86adc1687267728e0f6c579c1228523d23b2b192c746db460aab4ab

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 16 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe
    "C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1236
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:352
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:652
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1672
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\explorer.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2300
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2040
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sBJbJk28gh.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2596
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:2528
              • C:\Recovery\WindowsRE\spoolsv.exe
                "C:\Recovery\WindowsRE\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1472
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5104
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:1000
                    • C:\Recovery\WindowsRE\spoolsv.exe
                      "C:\Recovery\WindowsRE\spoolsv.exe"
                      8⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4524
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2104
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:3260
                          • C:\Recovery\WindowsRE\spoolsv.exe
                            "C:\Recovery\WindowsRE\spoolsv.exe"
                            10⤵
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3736
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2328
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:4676
                                • C:\Recovery\WindowsRE\spoolsv.exe
                                  "C:\Recovery\WindowsRE\spoolsv.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4760
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4820
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:1676
                                      • C:\Recovery\WindowsRE\spoolsv.exe
                                        "C:\Recovery\WindowsRE\spoolsv.exe"
                                        14⤵
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:2484
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1184
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:1484
                                            • C:\Recovery\WindowsRE\spoolsv.exe
                                              "C:\Recovery\WindowsRE\spoolsv.exe"
                                              16⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2324
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"
                                                17⤵
                                                  PID:340
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    18⤵
                                                      PID:2592
                                                    • C:\Recovery\WindowsRE\spoolsv.exe
                                                      "C:\Recovery\WindowsRE\spoolsv.exe"
                                                      18⤵
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1872
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"
                                                        19⤵
                                                          PID:4892
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            20⤵
                                                              PID:2288
                                                            • C:\Recovery\WindowsRE\spoolsv.exe
                                                              "C:\Recovery\WindowsRE\spoolsv.exe"
                                                              20⤵
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3952
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"
                                                                21⤵
                                                                  PID:2244
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    22⤵
                                                                      PID:1308
                                                                    • C:\Recovery\WindowsRE\spoolsv.exe
                                                                      "C:\Recovery\WindowsRE\spoolsv.exe"
                                                                      22⤵
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4336
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"
                                                                        23⤵
                                                                          PID:3012
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            24⤵
                                                                              PID:2020
                                                                            • C:\Recovery\WindowsRE\spoolsv.exe
                                                                              "C:\Recovery\WindowsRE\spoolsv.exe"
                                                                              24⤵
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:788
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"
                                                                                25⤵
                                                                                  PID:928
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    26⤵
                                                                                      PID:740
                                                                                    • C:\Recovery\WindowsRE\spoolsv.exe
                                                                                      "C:\Recovery\WindowsRE\spoolsv.exe"
                                                                                      26⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:588
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat"
                                                                                        27⤵
                                                                                          PID:2620
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            28⤵
                                                                                              PID:4604
                                                                                            • C:\Recovery\WindowsRE\spoolsv.exe
                                                                                              "C:\Recovery\WindowsRE\spoolsv.exe"
                                                                                              28⤵
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:4296
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
                                                                                                29⤵
                                                                                                  PID:4948
                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                    30⤵
                                                                                                      PID:2528
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4524
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:3180
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4364
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\dwm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4308
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4644
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4640
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4636
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:5076
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4976
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4984
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4948
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4620
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4292
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4328
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:3736
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:2804
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4344
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4564
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\odt\ShellExperienceHost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4336
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4508
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4348
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\odt\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4464
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4552
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:1816
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:576
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:4532
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Creates scheduled task(s)
                                            PID:496

                                          Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Recovery\WindowsRE\spoolsv.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  8592ba100a78835a6b94d5949e13dfc1

                                                  SHA1

                                                  63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                  SHA256

                                                  fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                  SHA512

                                                  87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  d63ff49d7c92016feb39812e4db10419

                                                  SHA1

                                                  2307d5e35ca9864ffefc93acf8573ea995ba189b

                                                  SHA256

                                                  375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

                                                  SHA512

                                                  00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  421e39960950550f715f82be33581365

                                                  SHA1

                                                  372baf7e7fef7be5f1d361e03d1b903868937571

                                                  SHA256

                                                  76609a3a50e1977c5ca41051e2d073276a59b32726cda43344623a480012423a

                                                  SHA512

                                                  5f0d30ce90e9fd89b45fd84c3a89f9325d158b962ad792282f178f386288566d4ac5c01bc8bf9ba77d6d19e14292d0c1ea12e2b6aec66a6619f9da2be40371dd

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  421e39960950550f715f82be33581365

                                                  SHA1

                                                  372baf7e7fef7be5f1d361e03d1b903868937571

                                                  SHA256

                                                  76609a3a50e1977c5ca41051e2d073276a59b32726cda43344623a480012423a

                                                  SHA512

                                                  5f0d30ce90e9fd89b45fd84c3a89f9325d158b962ad792282f178f386288566d4ac5c01bc8bf9ba77d6d19e14292d0c1ea12e2b6aec66a6619f9da2be40371dd

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  ea8eb4c93b171a1bd8f78c2f8d3c5f91

                                                  SHA1

                                                  c974b8f55f8e9523e09efcca15e98bbc3fdaecf9

                                                  SHA256

                                                  c28a2524ce1c2ae80134f7706c2635ebab867c3f72a765c379e52a39f6b33eaa

                                                  SHA512

                                                  842566248d47165c75a0c8a0c68a5c4a86b53dcaa847bc87e68f009a806cd985845976ae2a0268e7951f580f1cb850398a73e3c18be18d142619b23987b73878

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  ea8eb4c93b171a1bd8f78c2f8d3c5f91

                                                  SHA1

                                                  c974b8f55f8e9523e09efcca15e98bbc3fdaecf9

                                                  SHA256

                                                  c28a2524ce1c2ae80134f7706c2635ebab867c3f72a765c379e52a39f6b33eaa

                                                  SHA512

                                                  842566248d47165c75a0c8a0c68a5c4a86b53dcaa847bc87e68f009a806cd985845976ae2a0268e7951f580f1cb850398a73e3c18be18d142619b23987b73878

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  f514438363ffa9b3951e27d3c10c75b2

                                                  SHA1

                                                  6995a5f21b5aa8beba88c8b30b4357025a16df79

                                                  SHA256

                                                  0956293a1c56f5030108781830b7c202eaee7681ca82dda6712d2482e2f67a0c

                                                  SHA512

                                                  176354fce7b0b44654ca437a906d2f3e1bb72b41be0ef2c5ce0f3c287aef8a3e7ac2fb5fa5eaf6a54a8b9ab50572ea38eb07668986a1407df498a83d88e80798

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  f514438363ffa9b3951e27d3c10c75b2

                                                  SHA1

                                                  6995a5f21b5aa8beba88c8b30b4357025a16df79

                                                  SHA256

                                                  0956293a1c56f5030108781830b7c202eaee7681ca82dda6712d2482e2f67a0c

                                                  SHA512

                                                  176354fce7b0b44654ca437a906d2f3e1bb72b41be0ef2c5ce0f3c287aef8a3e7ac2fb5fa5eaf6a54a8b9ab50572ea38eb07668986a1407df498a83d88e80798

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  ef31740373cee50f1bf477a4b8057e10

                                                  SHA1

                                                  161a84eb96c22570c80d2b850037d0d00d6a52a6

                                                  SHA256

                                                  00e35be7afc50303df34cc7a15463c6e2c94cf1b87b10d432ac7a88565f081f3

                                                  SHA512

                                                  9c89622d9dcd53ae74ce1761c06ffddd6a9cf9f47369bc068cef2a54ad6f57aba0b2bf158b366c692e3e364c82618a87139b7972b75334e23ff83bd472b2ffd9

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  1f13758879487e904ad89ebd0847e36d

                                                  SHA1

                                                  39129d09ccf4478826d662dbd70254080be055b1

                                                  SHA256

                                                  853b6287b37f4e0deb5869dd967b8071d363db621376839047934313d6866eec

                                                  SHA512

                                                  bab5797881643bda8ee00e8b83e24e93c53d8e26b590ee3e5518c0bc7460ceeca0e056023b88e459021a47557d38dd83ac6bed8b02682a2989a114e34f8cbebf

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  666645396c2ed47289bcde84115d9d2c

                                                  SHA1

                                                  1dacfec155d8a12dcc82fe379065a2e8c40f0f2c

                                                  SHA256

                                                  2913fcb0ba9c883a39984545cc43be1a35b2cc4675304f109aec03ce197be6c5

                                                  SHA512

                                                  01f79e028aa30418f6e37f420fb16ec7102c4a02a0051bec89528d42743ac1861e859125636024fe83de58a3dd97d31f468e5070a579706b42846f9499fd2efe

                                                • C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  fc9a5b3cdb4765a782ee32dc35d1ef8d

                                                  SHA1

                                                  1a6f857944adbc26dd0e322f3f4976c1ac14f93f

                                                  SHA256

                                                  9d8562c9643cead7488f241776caf384348b0ea4a161e4eb41ffc9cb4e87041e

                                                  SHA512

                                                  118ab01000b29f1b0eb03cbc80fe849a1ede5538b42b693134fa0d4c800e22774ead04d92cfafae393067f89b1cf34fbdd3cd39bee82d346e68d1abd30d3a622

                                                • C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  325a795191daf24c6df63e95c7ceab19

                                                  SHA1

                                                  6a050fdfec2223910a8ef9a5082cdda998c61e6b

                                                  SHA256

                                                  c67d04ed80a9b9a58515aa3c375ae2a34d95696dec2e693d86aa422508f4bd9c

                                                  SHA512

                                                  7032ff62632bb08f9a35e554a4c3cd584d6534b137a21d68031ad9057288582b65773bc50e16788cca390dab2f99e6353cf0010cd864a34c907390a0216387b1

                                                • C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  547a461fdb19bb43a56db4f53f4dc3c9

                                                  SHA1

                                                  71f47a5441566c18f9cc2c76b1f7aa45b75d5bd3

                                                  SHA256

                                                  b5031c391cf43e34116b80834d76c0394a349dd264d35d067a52580474357ffb

                                                  SHA512

                                                  97dd567aea9bd2dae8b07263e400eb54b9a21397f58523f0bfb469f2a014de5fbcfa78fa1a97cb219fedb1670aaf6412e779379aed19e152ff44e49ecdf6ade5

                                                • C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  4c0d0ab3bbf515d49e5c510cc3ffeb6a

                                                  SHA1

                                                  01778d9dd07a5607b70284ca0947e4908b8d7dbf

                                                  SHA256

                                                  02dccf4166f1c72addd10b315d07c79aa773a126a444b624f1dfa9c6cbd76358

                                                  SHA512

                                                  b018665a1ce5625501dff538115690c537fda338efb84103cc4dee3930a12a571cec674fc2b47f25bb69ec63821d5b324507cc2dc9124bd4b3c42540818118f7

                                                • C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  c1900bc50afe99f855efce82d4303032

                                                  SHA1

                                                  273131703df6ab06f04c8006b22755fe2861cde5

                                                  SHA256

                                                  bafb1653a83c5fa715716056c39ab409d3956d257e3f812ce5846abda9f85afd

                                                  SHA512

                                                  2e05a9e474fc7b24677157bae4f72d834c23526b90f93301c2dbfcc2777b4d5382b4d3293d474efc4a4a256cfdd7e83cd14132790dcc69a263ce35479e469393

                                                • C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  c1900bc50afe99f855efce82d4303032

                                                  SHA1

                                                  273131703df6ab06f04c8006b22755fe2861cde5

                                                  SHA256

                                                  bafb1653a83c5fa715716056c39ab409d3956d257e3f812ce5846abda9f85afd

                                                  SHA512

                                                  2e05a9e474fc7b24677157bae4f72d834c23526b90f93301c2dbfcc2777b4d5382b4d3293d474efc4a4a256cfdd7e83cd14132790dcc69a263ce35479e469393

                                                • C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  6a0ac3f87f0d6133a327ceb5d6b3db34

                                                  SHA1

                                                  ceabd6090eaaa919da04c0cfc60ebccc0672e190

                                                  SHA256

                                                  1c913b5c4f211db5f6101e33fd1fcca8dde5cb2e4e4a35d98b94d185c45c6133

                                                  SHA512

                                                  139c874018d4466f7b52e2b7d86e77c01d5fa9b4effb1868be0540d0cdcbd5eb8a38b01069b957cfef69cf609f8aaa1804c2a6b70f88c48998b08fc0ff7cd006

                                                • C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  f0e1599c371c3095521a21b727ad8967

                                                  SHA1

                                                  f96e0f661517e33af5bb81ac3380f0916646b2bf

                                                  SHA256

                                                  e0c610b81f9e560698b92fe92f42b53de53fe30fd18bc7118caebf90217bf360

                                                  SHA512

                                                  a6cd39e815e451886c791549b7c23253409f56cb23e35cb94ff9ae395d4fba2cb849cc5bc8e5642913b94178cd0adf02abc68a458b026c9a8e15630ad1ffae2a

                                                • C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  f885dcfe6d48f2daf10544227e14b5a5

                                                  SHA1

                                                  aca2ea8b6b69db61c27b1115a3aac778bb1d0e6c

                                                  SHA256

                                                  a7af0a8177a592b94aaf72e97645a742fc2a4af962c00ace41358b41e9c9b6b3

                                                  SHA512

                                                  52d003e5c40583385c9510c77fdf85f757113410b62b5d502fd26ddfa4cd47a596e185e193ceba1109b930843ef0546bc7c01cdc0ecd8fb20f5872dcf1f55894

                                                • C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  f885dcfe6d48f2daf10544227e14b5a5

                                                  SHA1

                                                  aca2ea8b6b69db61c27b1115a3aac778bb1d0e6c

                                                  SHA256

                                                  a7af0a8177a592b94aaf72e97645a742fc2a4af962c00ace41358b41e9c9b6b3

                                                  SHA512

                                                  52d003e5c40583385c9510c77fdf85f757113410b62b5d502fd26ddfa4cd47a596e185e193ceba1109b930843ef0546bc7c01cdc0ecd8fb20f5872dcf1f55894

                                                • C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  fa464199b176005c76f8af55b2a0799b

                                                  SHA1

                                                  e63ce5bcd0735183d7e3e4ee081c3259add2a592

                                                  SHA256

                                                  27de1a5ae38997eab8dcb9911fa1db37ca5ea2084ed3811fa7c8c03c760f86be

                                                  SHA512

                                                  d3f2cf206f21f0f8a2cf07de92d3c1df2f33adfd12d76f6d4e163bdb239036e3cec6f1873288a950640106144e9aac8ee95cc7dd3fd6da4cd1c7ce1927d7bfd2

                                                • C:\Users\Admin\AppData\Local\Temp\sBJbJk28gh.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  59f1b0f68a77fbe4451bcc3295c18883

                                                  SHA1

                                                  3274d08f3685f12efb2c250ca7fa6d15cc5e30fe

                                                  SHA256

                                                  470d28a0b257f5088336c41705289793127c941f5d7ddef7755fd66ec5171778

                                                  SHA512

                                                  7156fc1ccab3e52bd32bcd227ab89d42254cf077ffbc37149249abca7cf29cf070c3eb4b80de2336522be7d70700cd896a9b65c157715b682bbe90a295d14041

                                                • C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat

                                                  Filesize

                                                  198B

                                                  MD5

                                                  c6df2a7a2b948a9ce9ca761669ab593c

                                                  SHA1

                                                  fcd185a36f3671f50c33845a17e3c0932d1d443b

                                                  SHA256

                                                  bde96febed1f0e8f509f7a0a653a2cd98533efc2fee1ca0a76f4d1193bc4cfbb

                                                  SHA512

                                                  392910b556f863e866bc31f668daf3c31816a5366e6ad29817111b9995b806cf5c31f28724c91a411bc41fc921d4bc2d8cb437f1ae1869ed31f80195f52f3999

                                                • C:\providercommon\1zu9dW.bat

                                                  Filesize

                                                  36B

                                                  MD5

                                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                                  SHA1

                                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                  SHA256

                                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                  SHA512

                                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                • C:\providercommon\DllCommonsvc.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\providercommon\DllCommonsvc.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                  Filesize

                                                  197B

                                                  MD5

                                                  8088241160261560a02c84025d107592

                                                  SHA1

                                                  083121f7027557570994c9fc211df61730455bb5

                                                  SHA256

                                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                  SHA512

                                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                • memory/588-699-0x0000000001070000-0x0000000001082000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/1236-341-0x0000017E28AE0000-0x0000017E28B56000-memory.dmp

                                                  Filesize

                                                  472KB

                                                • memory/1236-338-0x0000017E107E0000-0x0000017E10802000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/2484-668-0x0000000001570000-0x0000000001582000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-171-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/3736-657-0x0000000001760000-0x0000000001772000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/3948-286-0x0000000001270000-0x000000000127C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/3948-282-0x0000000000880000-0x0000000000990000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3948-284-0x0000000000FB0000-0x0000000000FBC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/3948-283-0x0000000000FA0000-0x0000000000FB2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/3948-285-0x0000000001250000-0x000000000125C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/4296-705-0x0000000001370000-0x0000000001382000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/4524-651-0x00000000015C0000-0x00000000015D2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/4892-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB

                                                • memory/4892-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp

                                                  Filesize

                                                  1.6MB