Analysis Overview
SHA256
aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1
Threat Level: Known bad
The file aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1 was found to be: Known bad.
Malicious Activity Summary
DCRat payload
DcRat
Dcrat family
Process spawned unexpected child process
DCRat payload
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Drops file in Program Files directory
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-11-01 11:41
Signatures
DCRat payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Dcrat family
Analysis: behavioral1
Detonation Overview
Submitted
2022-11-01 11:41
Reported
2022-11-01 11:44
Platform
win10-20220812-en
Max time kernel
159s
Max time network
162s
Command Line
Signatures
DcRat
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe | |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\schtasks.exe |
DCRat payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\providercommon\DllCommonsvc.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| N/A | N/A | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Program Files\Mozilla Firefox\browser\VisualElements\27d1bcfc3c54e0 | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe | C:\providercommon\DllCommonsvc.exe | N/A |
| File created | C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\6cb0b6c459d5d3 | C:\providercommon\DllCommonsvc.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\providercommon\DllCommonsvc.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings | C:\Recovery\WindowsRE\spoolsv.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe
"C:\Users\Admin\AppData\Local\Temp\aac02c9dfadc6ed9f7431ead74d36c60110a0b24de36865406d772023c8c4fe1.exe"
C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\dwm.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\odt\ShellExperienceHost.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\odt\explorer.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\VisualElements\System.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\6FCE168E-7DC5-43EA-A0C4-63DD4FBAAB89\root\dwm.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\dwm.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\explorer.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sBJbJk28gh.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| GB | 51.105.71.136:443 | tcp | |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
Files
memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-171-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/4892-180-0x0000000000000000-mapping.dmp
memory/4892-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp
memory/4892-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
| MD5 | 8088241160261560a02c84025d107592 |
| SHA1 | 083121f7027557570994c9fc211df61730455bb5 |
| SHA256 | 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1 |
| SHA512 | 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478 |
C:\providercommon\1zu9dW.bat
| MD5 | 6783c3ee07c7d151ceac57f1f9c8bed7 |
| SHA1 | 17468f98f95bf504cc1f83c49e49a78526b3ea03 |
| SHA256 | 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322 |
| SHA512 | c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8 |
memory/4448-256-0x0000000000000000-mapping.dmp
memory/3948-279-0x0000000000000000-mapping.dmp
C:\providercommon\DllCommonsvc.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
C:\providercommon\DllCommonsvc.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/3948-282-0x0000000000880000-0x0000000000990000-memory.dmp
memory/3948-283-0x0000000000FA0000-0x0000000000FB2000-memory.dmp
memory/3948-284-0x0000000000FB0000-0x0000000000FBC000-memory.dmp
memory/3948-285-0x0000000001250000-0x000000000125C000-memory.dmp
memory/3948-286-0x0000000001270000-0x000000000127C000-memory.dmp
memory/1236-287-0x0000000000000000-mapping.dmp
memory/652-292-0x0000000000000000-mapping.dmp
memory/352-291-0x0000000000000000-mapping.dmp
memory/612-290-0x0000000000000000-mapping.dmp
memory/1672-289-0x0000000000000000-mapping.dmp
memory/1112-288-0x0000000000000000-mapping.dmp
memory/3280-293-0x0000000000000000-mapping.dmp
memory/3288-294-0x0000000000000000-mapping.dmp
memory/2300-295-0x0000000000000000-mapping.dmp
memory/2040-298-0x0000000000000000-mapping.dmp
memory/2596-331-0x0000000000000000-mapping.dmp
memory/1236-338-0x0000017E107E0000-0x0000017E10802000-memory.dmp
memory/1236-341-0x0000017E28AE0000-0x0000017E28B56000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sBJbJk28gh.bat
| MD5 | 59f1b0f68a77fbe4451bcc3295c18883 |
| SHA1 | 3274d08f3685f12efb2c250ca7fa6d15cc5e30fe |
| SHA256 | 470d28a0b257f5088336c41705289793127c941f5d7ddef7755fd66ec5171778 |
| SHA512 | 7156fc1ccab3e52bd32bcd227ab89d42254cf077ffbc37149249abca7cf29cf070c3eb4b80de2336522be7d70700cd896a9b65c157715b682bbe90a295d14041 |
memory/2528-394-0x0000000000000000-mapping.dmp
memory/1472-602-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 421e39960950550f715f82be33581365 |
| SHA1 | 372baf7e7fef7be5f1d361e03d1b903868937571 |
| SHA256 | 76609a3a50e1977c5ca41051e2d073276a59b32726cda43344623a480012423a |
| SHA512 | 5f0d30ce90e9fd89b45fd84c3a89f9325d158b962ad792282f178f386288566d4ac5c01bc8bf9ba77d6d19e14292d0c1ea12e2b6aec66a6619f9da2be40371dd |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 421e39960950550f715f82be33581365 |
| SHA1 | 372baf7e7fef7be5f1d361e03d1b903868937571 |
| SHA256 | 76609a3a50e1977c5ca41051e2d073276a59b32726cda43344623a480012423a |
| SHA512 | 5f0d30ce90e9fd89b45fd84c3a89f9325d158b962ad792282f178f386288566d4ac5c01bc8bf9ba77d6d19e14292d0c1ea12e2b6aec66a6619f9da2be40371dd |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | ea8eb4c93b171a1bd8f78c2f8d3c5f91 |
| SHA1 | c974b8f55f8e9523e09efcca15e98bbc3fdaecf9 |
| SHA256 | c28a2524ce1c2ae80134f7706c2635ebab867c3f72a765c379e52a39f6b33eaa |
| SHA512 | 842566248d47165c75a0c8a0c68a5c4a86b53dcaa847bc87e68f009a806cd985845976ae2a0268e7951f580f1cb850398a73e3c18be18d142619b23987b73878 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | ea8eb4c93b171a1bd8f78c2f8d3c5f91 |
| SHA1 | c974b8f55f8e9523e09efcca15e98bbc3fdaecf9 |
| SHA256 | c28a2524ce1c2ae80134f7706c2635ebab867c3f72a765c379e52a39f6b33eaa |
| SHA512 | 842566248d47165c75a0c8a0c68a5c4a86b53dcaa847bc87e68f009a806cd985845976ae2a0268e7951f580f1cb850398a73e3c18be18d142619b23987b73878 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | f514438363ffa9b3951e27d3c10c75b2 |
| SHA1 | 6995a5f21b5aa8beba88c8b30b4357025a16df79 |
| SHA256 | 0956293a1c56f5030108781830b7c202eaee7681ca82dda6712d2482e2f67a0c |
| SHA512 | 176354fce7b0b44654ca437a906d2f3e1bb72b41be0ef2c5ce0f3c287aef8a3e7ac2fb5fa5eaf6a54a8b9ab50572ea38eb07668986a1407df498a83d88e80798 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | f514438363ffa9b3951e27d3c10c75b2 |
| SHA1 | 6995a5f21b5aa8beba88c8b30b4357025a16df79 |
| SHA256 | 0956293a1c56f5030108781830b7c202eaee7681ca82dda6712d2482e2f67a0c |
| SHA512 | 176354fce7b0b44654ca437a906d2f3e1bb72b41be0ef2c5ce0f3c287aef8a3e7ac2fb5fa5eaf6a54a8b9ab50572ea38eb07668986a1407df498a83d88e80798 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 8592ba100a78835a6b94d5949e13dfc1 |
| SHA1 | 63e901200ab9a57c7dd4c078d7f75dcd3b357020 |
| SHA256 | fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c |
| SHA512 | 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | ef31740373cee50f1bf477a4b8057e10 |
| SHA1 | 161a84eb96c22570c80d2b850037d0d00d6a52a6 |
| SHA256 | 00e35be7afc50303df34cc7a15463c6e2c94cf1b87b10d432ac7a88565f081f3 |
| SHA512 | 9c89622d9dcd53ae74ce1761c06ffddd6a9cf9f47369bc068cef2a54ad6f57aba0b2bf158b366c692e3e364c82618a87139b7972b75334e23ff83bd472b2ffd9 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 1f13758879487e904ad89ebd0847e36d |
| SHA1 | 39129d09ccf4478826d662dbd70254080be055b1 |
| SHA256 | 853b6287b37f4e0deb5869dd967b8071d363db621376839047934313d6866eec |
| SHA512 | bab5797881643bda8ee00e8b83e24e93c53d8e26b590ee3e5518c0bc7460ceeca0e056023b88e459021a47557d38dd83ac6bed8b02682a2989a114e34f8cbebf |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 666645396c2ed47289bcde84115d9d2c |
| SHA1 | 1dacfec155d8a12dcc82fe379065a2e8c40f0f2c |
| SHA256 | 2913fcb0ba9c883a39984545cc43be1a35b2cc4675304f109aec03ce197be6c5 |
| SHA512 | 01f79e028aa30418f6e37f420fb16ec7102c4a02a0051bec89528d42743ac1861e859125636024fe83de58a3dd97d31f468e5070a579706b42846f9499fd2efe |
memory/5104-645-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat
| MD5 | c1900bc50afe99f855efce82d4303032 |
| SHA1 | 273131703df6ab06f04c8006b22755fe2861cde5 |
| SHA256 | bafb1653a83c5fa715716056c39ab409d3956d257e3f812ce5846abda9f85afd |
| SHA512 | 2e05a9e474fc7b24677157bae4f72d834c23526b90f93301c2dbfcc2777b4d5382b4d3293d474efc4a4a256cfdd7e83cd14132790dcc69a263ce35479e469393 |
memory/1000-647-0x0000000000000000-mapping.dmp
memory/4524-648-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log
| MD5 | d63ff49d7c92016feb39812e4db10419 |
| SHA1 | 2307d5e35ca9864ffefc93acf8573ea995ba189b |
| SHA256 | 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12 |
| SHA512 | 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a |
memory/4524-651-0x00000000015C0000-0x00000000015D2000-memory.dmp
memory/2104-652-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat
| MD5 | 325a795191daf24c6df63e95c7ceab19 |
| SHA1 | 6a050fdfec2223910a8ef9a5082cdda998c61e6b |
| SHA256 | c67d04ed80a9b9a58515aa3c375ae2a34d95696dec2e693d86aa422508f4bd9c |
| SHA512 | 7032ff62632bb08f9a35e554a4c3cd584d6534b137a21d68031ad9057288582b65773bc50e16788cca390dab2f99e6353cf0010cd864a34c907390a0216387b1 |
memory/3260-654-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/3736-655-0x0000000000000000-mapping.dmp
memory/3736-657-0x0000000001760000-0x0000000001772000-memory.dmp
memory/2328-658-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\WRY5ahHPmz.bat
| MD5 | f0e1599c371c3095521a21b727ad8967 |
| SHA1 | f96e0f661517e33af5bb81ac3380f0916646b2bf |
| SHA256 | e0c610b81f9e560698b92fe92f42b53de53fe30fd18bc7118caebf90217bf360 |
| SHA512 | a6cd39e815e451886c791549b7c23253409f56cb23e35cb94ff9ae395d4fba2cb849cc5bc8e5642913b94178cd0adf02abc68a458b026c9a8e15630ad1ffae2a |
memory/4676-660-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/4760-661-0x0000000000000000-mapping.dmp
memory/4820-663-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat
| MD5 | 547a461fdb19bb43a56db4f53f4dc3c9 |
| SHA1 | 71f47a5441566c18f9cc2c76b1f7aa45b75d5bd3 |
| SHA256 | b5031c391cf43e34116b80834d76c0394a349dd264d35d067a52580474357ffb |
| SHA512 | 97dd567aea9bd2dae8b07263e400eb54b9a21397f58523f0bfb469f2a014de5fbcfa78fa1a97cb219fedb1670aaf6412e779379aed19e152ff44e49ecdf6ade5 |
memory/1676-665-0x0000000000000000-mapping.dmp
memory/2484-666-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/2484-668-0x0000000001570000-0x0000000001582000-memory.dmp
memory/1184-669-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat
| MD5 | 4c0d0ab3bbf515d49e5c510cc3ffeb6a |
| SHA1 | 01778d9dd07a5607b70284ca0947e4908b8d7dbf |
| SHA256 | 02dccf4166f1c72addd10b315d07c79aa773a126a444b624f1dfa9c6cbd76358 |
| SHA512 | b018665a1ce5625501dff538115690c537fda338efb84103cc4dee3930a12a571cec674fc2b47f25bb69ec63821d5b324507cc2dc9124bd4b3c42540818118f7 |
memory/1484-671-0x0000000000000000-mapping.dmp
memory/2324-672-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/340-674-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat
| MD5 | c1900bc50afe99f855efce82d4303032 |
| SHA1 | 273131703df6ab06f04c8006b22755fe2861cde5 |
| SHA256 | bafb1653a83c5fa715716056c39ab409d3956d257e3f812ce5846abda9f85afd |
| SHA512 | 2e05a9e474fc7b24677157bae4f72d834c23526b90f93301c2dbfcc2777b4d5382b4d3293d474efc4a4a256cfdd7e83cd14132790dcc69a263ce35479e469393 |
memory/2592-676-0x0000000000000000-mapping.dmp
memory/1872-677-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/4892-679-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat
| MD5 | fc9a5b3cdb4765a782ee32dc35d1ef8d |
| SHA1 | 1a6f857944adbc26dd0e322f3f4976c1ac14f93f |
| SHA256 | 9d8562c9643cead7488f241776caf384348b0ea4a161e4eb41ffc9cb4e87041e |
| SHA512 | 118ab01000b29f1b0eb03cbc80fe849a1ede5538b42b693134fa0d4c800e22774ead04d92cfafae393067f89b1cf34fbdd3cd39bee82d346e68d1abd30d3a622 |
memory/2288-681-0x0000000000000000-mapping.dmp
memory/3952-682-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/2244-684-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat
| MD5 | f885dcfe6d48f2daf10544227e14b5a5 |
| SHA1 | aca2ea8b6b69db61c27b1115a3aac778bb1d0e6c |
| SHA256 | a7af0a8177a592b94aaf72e97645a742fc2a4af962c00ace41358b41e9c9b6b3 |
| SHA512 | 52d003e5c40583385c9510c77fdf85f757113410b62b5d502fd26ddfa4cd47a596e185e193ceba1109b930843ef0546bc7c01cdc0ecd8fb20f5872dcf1f55894 |
memory/1308-686-0x0000000000000000-mapping.dmp
memory/4336-687-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/3012-689-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat
| MD5 | fa464199b176005c76f8af55b2a0799b |
| SHA1 | e63ce5bcd0735183d7e3e4ee081c3259add2a592 |
| SHA256 | 27de1a5ae38997eab8dcb9911fa1db37ca5ea2084ed3811fa7c8c03c760f86be |
| SHA512 | d3f2cf206f21f0f8a2cf07de92d3c1df2f33adfd12d76f6d4e163bdb239036e3cec6f1873288a950640106144e9aac8ee95cc7dd3fd6da4cd1c7ce1927d7bfd2 |
memory/2020-691-0x0000000000000000-mapping.dmp
memory/788-692-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/928-694-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\Z87Ce65nyU.bat
| MD5 | f885dcfe6d48f2daf10544227e14b5a5 |
| SHA1 | aca2ea8b6b69db61c27b1115a3aac778bb1d0e6c |
| SHA256 | a7af0a8177a592b94aaf72e97645a742fc2a4af962c00ace41358b41e9c9b6b3 |
| SHA512 | 52d003e5c40583385c9510c77fdf85f757113410b62b5d502fd26ddfa4cd47a596e185e193ceba1109b930843ef0546bc7c01cdc0ecd8fb20f5872dcf1f55894 |
memory/740-696-0x0000000000000000-mapping.dmp
memory/588-697-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/588-699-0x0000000001070000-0x0000000001082000-memory.dmp
memory/2620-700-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat
| MD5 | c6df2a7a2b948a9ce9ca761669ab593c |
| SHA1 | fcd185a36f3671f50c33845a17e3c0932d1d443b |
| SHA256 | bde96febed1f0e8f509f7a0a653a2cd98533efc2fee1ca0a76f4d1193bc4cfbb |
| SHA512 | 392910b556f863e866bc31f668daf3c31816a5366e6ad29817111b9995b806cf5c31f28724c91a411bc41fc921d4bc2d8cb437f1ae1869ed31f80195f52f3999 |
memory/4604-702-0x0000000000000000-mapping.dmp
memory/4296-703-0x0000000000000000-mapping.dmp
C:\Recovery\WindowsRE\spoolsv.exe
| MD5 | bd31e94b4143c4ce49c17d3af46bcad0 |
| SHA1 | f8c51ff3ff909531d9469d4ba1bbabae101853ff |
| SHA256 | b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63 |
| SHA512 | f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394 |
memory/4296-705-0x0000000001370000-0x0000000001382000-memory.dmp
memory/4948-706-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat
| MD5 | 6a0ac3f87f0d6133a327ceb5d6b3db34 |
| SHA1 | ceabd6090eaaa919da04c0cfc60ebccc0672e190 |
| SHA256 | 1c913b5c4f211db5f6101e33fd1fcca8dde5cb2e4e4a35d98b94d185c45c6133 |
| SHA512 | 139c874018d4466f7b52e2b7d86e77c01d5fa9b4effb1868be0540d0cdcbd5eb8a38b01069b957cfef69cf609f8aaa1804c2a6b70f88c48998b08fc0ff7cd006 |
memory/2528-708-0x0000000000000000-mapping.dmp