Malware Analysis Report

2025-08-10 23:16

Sample ID 221101-ntxrkscebl
Target aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1
SHA256 aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1
Tags
rat dcrat infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1

Threat Level: Known bad

The file aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1 was found to be: Known bad.

Malicious Activity Summary

rat dcrat infostealer

DCRat payload

DcRat

Dcrat family

Process spawned unexpected child process

DCRat payload

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-01 11:41

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-01 11:41

Reported

2022-11-01 11:44

Platform

win10-20220812-en

Max time kernel

159s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\27d1bcfc3c54e0 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\6cb0b6c459d5d3 C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\providercommon\DllCommonsvc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings C:\Recovery\WindowsRE\spoolsv.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2716 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe C:\Windows\SysWOW64\WScript.exe
PID 2716 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe C:\Windows\SysWOW64\WScript.exe
PID 2716 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe C:\Windows\SysWOW64\WScript.exe
PID 4892 wrote to memory of 4448 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4892 wrote to memory of 4448 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4892 wrote to memory of 4448 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4448 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 4448 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 3948 wrote to memory of 1236 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1236 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1112 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1112 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1672 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 1672 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 612 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 612 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 352 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 352 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 652 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 652 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 3280 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 3280 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 3288 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 3288 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2300 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2300 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2040 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2040 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3948 wrote to memory of 2596 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 3948 wrote to memory of 2596 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 2596 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2596 wrote to memory of 2528 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2596 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 2596 wrote to memory of 1472 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 1472 wrote to memory of 5104 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 1472 wrote to memory of 5104 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 5104 wrote to memory of 1000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 5104 wrote to memory of 1000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 5104 wrote to memory of 4524 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 5104 wrote to memory of 4524 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 4524 wrote to memory of 2104 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 4524 wrote to memory of 2104 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 2104 wrote to memory of 3260 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2104 wrote to memory of 3260 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2104 wrote to memory of 3736 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 2104 wrote to memory of 3736 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 3736 wrote to memory of 2328 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 3736 wrote to memory of 2328 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 2328 wrote to memory of 4676 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2328 wrote to memory of 4676 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2328 wrote to memory of 4760 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 2328 wrote to memory of 4760 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 4760 wrote to memory of 4820 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 4760 wrote to memory of 4820 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 4820 wrote to memory of 1676 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4820 wrote to memory of 1676 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4820 wrote to memory of 2484 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 4820 wrote to memory of 2484 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 2484 wrote to memory of 1184 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 2484 wrote to memory of 1184 N/A C:\Recovery\WindowsRE\spoolsv.exe C:\Windows\System32\cmd.exe
PID 1184 wrote to memory of 1484 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1184 wrote to memory of 1484 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1184 wrote to memory of 2324 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 1184 wrote to memory of 2324 N/A C:\Windows\System32\cmd.exe C:\Recovery\WindowsRE\spoolsv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe

"C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\odt\ShellExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\odt\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sBJbJk28gh.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
GB 51.105.71.136:443 tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp

Files

memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-171-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/4892-180-0x0000000000000000-mapping.dmp

memory/4892-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp

memory/4892-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

memory/4448-256-0x0000000000000000-mapping.dmp

memory/3948-279-0x0000000000000000-mapping.dmp

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3948-282-0x0000000000880000-0x0000000000990000-memory.dmp

memory/3948-283-0x0000000000FA0000-0x0000000000FB2000-memory.dmp

memory/3948-284-0x0000000000FB0000-0x0000000000FBC000-memory.dmp

memory/3948-285-0x0000000001250000-0x000000000125C000-memory.dmp

memory/3948-286-0x0000000001270000-0x000000000127C000-memory.dmp

memory/1236-287-0x0000000000000000-mapping.dmp

memory/652-292-0x0000000000000000-mapping.dmp

memory/352-291-0x0000000000000000-mapping.dmp

memory/612-290-0x0000000000000000-mapping.dmp

memory/1672-289-0x0000000000000000-mapping.dmp

memory/1112-288-0x0000000000000000-mapping.dmp

memory/3280-293-0x0000000000000000-mapping.dmp

memory/3288-294-0x0000000000000000-mapping.dmp

memory/2300-295-0x0000000000000000-mapping.dmp

memory/2040-298-0x0000000000000000-mapping.dmp

memory/2596-331-0x0000000000000000-mapping.dmp

memory/1236-338-0x0000017E107E0000-0x0000017E10802000-memory.dmp

memory/1236-341-0x0000017E28AE0000-0x0000017E28B56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sBJbJk28gh.bat

MD5 59f1b0f68a77fbe4451bcc3295c18883
SHA1 3274d08f3685f12efb2c250ca7fa6d15cc5e30fe
SHA256 470d28a0b257f5088336c41705289793127c941f5d7ddef7755fd66ec5171778
SHA512 7156fc1ccab3e52bd32bcd227ab89d42254cf077ffbc37149249abca7cf29cf070c3eb4b80de2336522be7d70700cd896a9b65c157715b682bbe90a295d14041

memory/2528-394-0x0000000000000000-mapping.dmp

memory/1472-602-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 421e39960950550f715f82be33581365
SHA1 372baf7e7fef7be5f1d361e03d1b903868937571
SHA256 76609a3a50e1977c5ca41051e2d073276a59b32726cda43344623a480012423a
SHA512 5f0d30ce90e9fd89b45fd84c3a89f9325d158b962ad792282f178f386288566d4ac5c01bc8bf9ba77d6d19e14292d0c1ea12e2b6aec66a6619f9da2be40371dd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 421e39960950550f715f82be33581365
SHA1 372baf7e7fef7be5f1d361e03d1b903868937571
SHA256 76609a3a50e1977c5ca41051e2d073276a59b32726cda43344623a480012423a
SHA512 5f0d30ce90e9fd89b45fd84c3a89f9325d158b962ad792282f178f386288566d4ac5c01bc8bf9ba77d6d19e14292d0c1ea12e2b6aec66a6619f9da2be40371dd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ea8eb4c93b171a1bd8f78c2f8d3c5f91
SHA1 c974b8f55f8e9523e09efcca15e98bbc3fdaecf9
SHA256 c28a2524ce1c2ae80134f7706c2635ebab867c3f72a765c379e52a39f6b33eaa
SHA512 842566248d47165c75a0c8a0c68a5c4a86b53dcaa847bc87e68f009a806cd985845976ae2a0268e7951f580f1cb850398a73e3c18be18d142619b23987b73878

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ea8eb4c93b171a1bd8f78c2f8d3c5f91
SHA1 c974b8f55f8e9523e09efcca15e98bbc3fdaecf9
SHA256 c28a2524ce1c2ae80134f7706c2635ebab867c3f72a765c379e52a39f6b33eaa
SHA512 842566248d47165c75a0c8a0c68a5c4a86b53dcaa847bc87e68f009a806cd985845976ae2a0268e7951f580f1cb850398a73e3c18be18d142619b23987b73878

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f514438363ffa9b3951e27d3c10c75b2
SHA1 6995a5f21b5aa8beba88c8b30b4357025a16df79
SHA256 0956293a1c56f5030108781830b7c202eaee7681ca82dda6712d2482e2f67a0c
SHA512 176354fce7b0b44654ca437a906d2f3e1bb72b41be0ef2c5ce0f3c287aef8a3e7ac2fb5fa5eaf6a54a8b9ab50572ea38eb07668986a1407df498a83d88e80798

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f514438363ffa9b3951e27d3c10c75b2
SHA1 6995a5f21b5aa8beba88c8b30b4357025a16df79
SHA256 0956293a1c56f5030108781830b7c202eaee7681ca82dda6712d2482e2f67a0c
SHA512 176354fce7b0b44654ca437a906d2f3e1bb72b41be0ef2c5ce0f3c287aef8a3e7ac2fb5fa5eaf6a54a8b9ab50572ea38eb07668986a1407df498a83d88e80798

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ef31740373cee50f1bf477a4b8057e10
SHA1 161a84eb96c22570c80d2b850037d0d00d6a52a6
SHA256 00e35be7afc50303df34cc7a15463c6e2c94cf1b87b10d432ac7a88565f081f3
SHA512 9c89622d9dcd53ae74ce1761c06ffddd6a9cf9f47369bc068cef2a54ad6f57aba0b2bf158b366c692e3e364c82618a87139b7972b75334e23ff83bd472b2ffd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1f13758879487e904ad89ebd0847e36d
SHA1 39129d09ccf4478826d662dbd70254080be055b1
SHA256 853b6287b37f4e0deb5869dd967b8071d363db621376839047934313d6866eec
SHA512 bab5797881643bda8ee00e8b83e24e93c53d8e26b590ee3e5518c0bc7460ceeca0e056023b88e459021a47557d38dd83ac6bed8b02682a2989a114e34f8cbebf

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 666645396c2ed47289bcde84115d9d2c
SHA1 1dacfec155d8a12dcc82fe379065a2e8c40f0f2c
SHA256 2913fcb0ba9c883a39984545cc43be1a35b2cc4675304f109aec03ce197be6c5
SHA512 01f79e028aa30418f6e37f420fb16ec7102c4a02a0051bec89528d42743ac1861e859125636024fe83de58a3dd97d31f468e5070a579706b42846f9499fd2efe

memory/5104-645-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat

MD5 c1900bc50afe99f855efce82d4303032
SHA1 273131703df6ab06f04c8006b22755fe2861cde5
SHA256 bafb1653a83c5fa715716056c39ab409d3956d257e3f812ce5846abda9f85afd
SHA512 2e05a9e474fc7b24677157bae4f72d834c23526b90f93301c2dbfcc2777b4d5382b4d3293d474efc4a4a256cfdd7e83cd14132790dcc69a263ce35479e469393

memory/1000-647-0x0000000000000000-mapping.dmp

memory/4524-648-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

memory/4524-651-0x00000000015C0000-0x00000000015D2000-memory.dmp

memory/2104-652-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat

MD5 325a795191daf24c6df63e95c7ceab19
SHA1 6a050fdfec2223910a8ef9a5082cdda998c61e6b
SHA256 c67d04ed80a9b9a58515aa3c375ae2a34d95696dec2e693d86aa422508f4bd9c
SHA512 7032ff62632bb08f9a35e554a4c3cd584d6534b137a21d68031ad9057288582b65773bc50e16788cca390dab2f99e6353cf0010cd864a34c907390a0216387b1

memory/3260-654-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3736-655-0x0000000000000000-mapping.dmp

memory/3736-657-0x0000000001760000-0x0000000001772000-memory.dmp

memory/2328-658-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat

MD5 f0e1599c371c3095521a21b727ad8967
SHA1 f96e0f661517e33af5bb81ac3380f0916646b2bf
SHA256 e0c610b81f9e560698b92fe92f42b53de53fe30fd18bc7118caebf90217bf360
SHA512 a6cd39e815e451886c791549b7c23253409f56cb23e35cb94ff9ae395d4fba2cb849cc5bc8e5642913b94178cd0adf02abc68a458b026c9a8e15630ad1ffae2a

memory/4676-660-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4760-661-0x0000000000000000-mapping.dmp

memory/4820-663-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat

MD5 547a461fdb19bb43a56db4f53f4dc3c9
SHA1 71f47a5441566c18f9cc2c76b1f7aa45b75d5bd3
SHA256 b5031c391cf43e34116b80834d76c0394a349dd264d35d067a52580474357ffb
SHA512 97dd567aea9bd2dae8b07263e400eb54b9a21397f58523f0bfb469f2a014de5fbcfa78fa1a97cb219fedb1670aaf6412e779379aed19e152ff44e49ecdf6ade5

memory/1676-665-0x0000000000000000-mapping.dmp

memory/2484-666-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2484-668-0x0000000001570000-0x0000000001582000-memory.dmp

memory/1184-669-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

MD5 4c0d0ab3bbf515d49e5c510cc3ffeb6a
SHA1 01778d9dd07a5607b70284ca0947e4908b8d7dbf
SHA256 02dccf4166f1c72addd10b315d07c79aa773a126a444b624f1dfa9c6cbd76358
SHA512 b018665a1ce5625501dff538115690c537fda338efb84103cc4dee3930a12a571cec674fc2b47f25bb69ec63821d5b324507cc2dc9124bd4b3c42540818118f7

memory/1484-671-0x0000000000000000-mapping.dmp

memory/2324-672-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/340-674-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat

MD5 c1900bc50afe99f855efce82d4303032
SHA1 273131703df6ab06f04c8006b22755fe2861cde5
SHA256 bafb1653a83c5fa715716056c39ab409d3956d257e3f812ce5846abda9f85afd
SHA512 2e05a9e474fc7b24677157bae4f72d834c23526b90f93301c2dbfcc2777b4d5382b4d3293d474efc4a4a256cfdd7e83cd14132790dcc69a263ce35479e469393

memory/2592-676-0x0000000000000000-mapping.dmp

memory/1872-677-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4892-679-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat

MD5 fc9a5b3cdb4765a782ee32dc35d1ef8d
SHA1 1a6f857944adbc26dd0e322f3f4976c1ac14f93f
SHA256 9d8562c9643cead7488f241776caf384348b0ea4a161e4eb41ffc9cb4e87041e
SHA512 118ab01000b29f1b0eb03cbc80fe849a1ede5538b42b693134fa0d4c800e22774ead04d92cfafae393067f89b1cf34fbdd3cd39bee82d346e68d1abd30d3a622

memory/2288-681-0x0000000000000000-mapping.dmp

memory/3952-682-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2244-684-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat

MD5 f885dcfe6d48f2daf10544227e14b5a5
SHA1 aca2ea8b6b69db61c27b1115a3aac778bb1d0e6c
SHA256 a7af0a8177a592b94aaf72e97645a742fc2a4af962c00ace41358b41e9c9b6b3
SHA512 52d003e5c40583385c9510c77fdf85f757113410b62b5d502fd26ddfa4cd47a596e185e193ceba1109b930843ef0546bc7c01cdc0ecd8fb20f5872dcf1f55894

memory/1308-686-0x0000000000000000-mapping.dmp

memory/4336-687-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3012-689-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat

MD5 fa464199b176005c76f8af55b2a0799b
SHA1 e63ce5bcd0735183d7e3e4ee081c3259add2a592
SHA256 27de1a5ae38997eab8dcb9911fa1db37ca5ea2084ed3811fa7c8c03c760f86be
SHA512 d3f2cf206f21f0f8a2cf07de92d3c1df2f33adfd12d76f6d4e163bdb239036e3cec6f1873288a950640106144e9aac8ee95cc7dd3fd6da4cd1c7ce1927d7bfd2

memory/2020-691-0x0000000000000000-mapping.dmp

memory/788-692-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/928-694-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat

MD5 f885dcfe6d48f2daf10544227e14b5a5
SHA1 aca2ea8b6b69db61c27b1115a3aac778bb1d0e6c
SHA256 a7af0a8177a592b94aaf72e97645a742fc2a4af962c00ace41358b41e9c9b6b3
SHA512 52d003e5c40583385c9510c77fdf85f757113410b62b5d502fd26ddfa4cd47a596e185e193ceba1109b930843ef0546bc7c01cdc0ecd8fb20f5872dcf1f55894

memory/740-696-0x0000000000000000-mapping.dmp

memory/588-697-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/588-699-0x0000000001070000-0x0000000001082000-memory.dmp

memory/2620-700-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat

MD5 c6df2a7a2b948a9ce9ca761669ab593c
SHA1 fcd185a36f3671f50c33845a17e3c0932d1d443b
SHA256 bde96febed1f0e8f509f7a0a653a2cd98533efc2fee1ca0a76f4d1193bc4cfbb
SHA512 392910b556f863e866bc31f668daf3c31816a5366e6ad29817111b9995b806cf5c31f28724c91a411bc41fc921d4bc2d8cb437f1ae1869ed31f80195f52f3999

memory/4604-702-0x0000000000000000-mapping.dmp

memory/4296-703-0x0000000000000000-mapping.dmp

C:\Recovery\WindowsRE\spoolsv.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4296-705-0x0000000001370000-0x0000000001382000-memory.dmp

memory/4948-706-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

MD5 6a0ac3f87f0d6133a327ceb5d6b3db34
SHA1 ceabd6090eaaa919da04c0cfc60ebccc0672e190
SHA256 1c913b5c4f211db5f6101e33fd1fcca8dde5cb2e4e4a35d98b94d185c45c6133
SHA512 139c874018d4466f7b52e2b7d86e77c01d5fa9b4effb1868be0540d0cdcbd5eb8a38b01069b957cfef69cf609f8aaa1804c2a6b70f88c48998b08fc0ff7cd006

memory/2528-708-0x0000000000000000-mapping.dmp