Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/11/2022, 12:12

General

  • Target

    c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe

  • Size

    1.3MB

  • MD5

    ba66a82f7fdf3d053ee98f72e02c5eb8

  • SHA1

    19d2b3161a4d3bf0fedece59ef89ce6ae9373332

  • SHA256

    c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b

  • SHA512

    251bb335defd83c9f79728b9b12516d5941faf8a1b3741e48f93b98d5a902dbd450771c07d6b9e81636f5c370f2fc358f89a067df8d47bf1a2f223d147a84f58

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 45 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 14 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 11 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 45 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe
    "C:\Users\Admin\AppData\Local\Temp\c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:68
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2516
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3840
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2512
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:868
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\System.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3732
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kM739AVLL2.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4780
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:4940
              • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                6⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:5164
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5408
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:5464
                    • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                      "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                      8⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:5484
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5588
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:5644
                          • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                            "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                            10⤵
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:5664
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5768
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:5824
                                • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                  "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  PID:5844
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat"
                                    13⤵
                                      PID:5948
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        14⤵
                                          PID:6004
                                        • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                          "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                          14⤵
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          PID:6024
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"
                                            15⤵
                                              PID:6128
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                16⤵
                                                  PID:2656
                                                • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                                  "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                                  16⤵
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  PID:1652
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat"
                                                    17⤵
                                                      PID:4336
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        18⤵
                                                          PID:3464
                                                        • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                                          "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                                          18⤵
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          PID:196
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"
                                                            19⤵
                                                              PID:3988
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                20⤵
                                                                  PID:648
                                                                • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                                                  "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                                                  20⤵
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  PID:2400
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat"
                                                                    21⤵
                                                                      PID:3296
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        22⤵
                                                                          PID:5124
                                                                        • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                                                          "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                                                          22⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          PID:4844
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat"
                                                                            23⤵
                                                                              PID:4968
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                24⤵
                                                                                  PID:2356
                                                                                • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
                                                                                  "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
                                                                                  24⤵
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  PID:1792
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
                                                                                    25⤵
                                                                                      PID:1664
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        26⤵
                                                                                          PID:4684
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4536
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4312
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\wininit.exe'
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4092
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2500
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4852
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
                                                5⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3496
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3116
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4436
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3244
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3744
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3572
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4304
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2984
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:5092
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4488
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2932
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4764
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4756
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4792
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3016
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3272
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4796
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4692
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4680
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3172
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4804
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4652
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4668
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4572
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:496
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:640
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:504
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:420
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1800
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1332
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1792
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\System.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1636
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1184
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1036
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\wininit.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:688
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\INF\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2020
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:760
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:580
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:96
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:188
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:208
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3288
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2252
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1820
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2128
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:5044

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        b4268d8ae66fdd920476b97a1776bf85

                                        SHA1

                                        f920de54f7467f0970eccc053d3c6c8dd181d49a

                                        SHA256

                                        61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

                                        SHA512

                                        03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        3KB

                                        MD5

                                        ad5cd538ca58cb28ede39c108acb5785

                                        SHA1

                                        1ae910026f3dbe90ed025e9e96ead2b5399be877

                                        SHA256

                                        c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

                                        SHA512

                                        c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        f42672d2cfc54ba70fa0542d5743843a

                                        SHA1

                                        5bf3a7521f2ec605de70aa3f3ab410c8c800cc9d

                                        SHA256

                                        3e8c707725c53855be98cc864d3581fdf2ac5b3ad3aaf1ffecb9886ef0f0ce56

                                        SHA512

                                        794ed957dbaf4904a2dbe1691052c9464b2184567f1915d441d46e89e03b97765101e046a31c83757c10233262cc77a23a9a763be01e4adc10d432eebb475f77

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        68de62fe66f9b492e94e98ced7737bf4

                                        SHA1

                                        6681849abb88363f3e0cedaec84535faea0221bd

                                        SHA256

                                        da45781ef0aad5448310a4a4d5ad8cedb4c72eddba621fd2e111ad8be953c32e

                                        SHA512

                                        aec608aa0ef68da637cd021d970b54aa76e071c1441e4ab0239bd7085f2290f10b3e5bc5c0b533e5b06717c5ee307f46c07625ed0398428b9fecbca7ce20186a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        b9105535614bcc8e6b0467dbee18fdcc

                                        SHA1

                                        04963aede8462ec0236f6bac81f87912a4d309f9

                                        SHA256

                                        a4344e0dc1af70a964d819a2e181dedae2c0539ee3111ca3acc97e9110f6bb34

                                        SHA512

                                        c3e98ee9fb4f2881aa62b8edb202b31e48faca65b352d563f43b81440279490e50114b07cb557ef75171bbb738ab2ef8170ab297e4286e808e80005918dcd5bf

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        edb6d13ebb9d0829280d4e4f597fd8f9

                                        SHA1

                                        1ef5eaaa6ab6444fb2f121355d0ffe586609580e

                                        SHA256

                                        9ab5072aaf0c58d5ec25adcb39591ea0e9be71b8ab8fc335035d1e2e039a9d2c

                                        SHA512

                                        de8b58e06b02da74ff8e10641fe9d08e55d4a391bffc4f271259b5a7d16f00f7d71be7dce9e47b0e7edffead388cde30c7edbc45fb8ab982afffc3db17722377

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        0c2709cb9970c0cf43ca4ce2e057139a

                                        SHA1

                                        d91a16f847cc7adb46c0542aa67974c7d5c14b00

                                        SHA256

                                        5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

                                        SHA512

                                        5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        2701eb1c330a8391ec6e9902a187a6ae

                                        SHA1

                                        36fd17e7f4df322a5ed547983864df0ddd8f3030

                                        SHA256

                                        5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

                                        SHA512

                                        ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        0c2709cb9970c0cf43ca4ce2e057139a

                                        SHA1

                                        d91a16f847cc7adb46c0542aa67974c7d5c14b00

                                        SHA256

                                        5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

                                        SHA512

                                        5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        2701eb1c330a8391ec6e9902a187a6ae

                                        SHA1

                                        36fd17e7f4df322a5ed547983864df0ddd8f3030

                                        SHA256

                                        5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

                                        SHA512

                                        ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        2701eb1c330a8391ec6e9902a187a6ae

                                        SHA1

                                        36fd17e7f4df322a5ed547983864df0ddd8f3030

                                        SHA256

                                        5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

                                        SHA512

                                        ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        0c2709cb9970c0cf43ca4ce2e057139a

                                        SHA1

                                        d91a16f847cc7adb46c0542aa67974c7d5c14b00

                                        SHA256

                                        5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

                                        SHA512

                                        5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        2701eb1c330a8391ec6e9902a187a6ae

                                        SHA1

                                        36fd17e7f4df322a5ed547983864df0ddd8f3030

                                        SHA256

                                        5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

                                        SHA512

                                        ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        2701eb1c330a8391ec6e9902a187a6ae

                                        SHA1

                                        36fd17e7f4df322a5ed547983864df0ddd8f3030

                                        SHA256

                                        5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

                                        SHA512

                                        ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        2701eb1c330a8391ec6e9902a187a6ae

                                        SHA1

                                        36fd17e7f4df322a5ed547983864df0ddd8f3030

                                        SHA256

                                        5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

                                        SHA512

                                        ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        0c2709cb9970c0cf43ca4ce2e057139a

                                        SHA1

                                        d91a16f847cc7adb46c0542aa67974c7d5c14b00

                                        SHA256

                                        5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

                                        SHA512

                                        5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        1KB

                                        MD5

                                        0c2709cb9970c0cf43ca4ce2e057139a

                                        SHA1

                                        d91a16f847cc7adb46c0542aa67974c7d5c14b00

                                        SHA256

                                        5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

                                        SHA512

                                        5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

                                      • C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

                                        Filesize

                                        229B

                                        MD5

                                        9d7abfda6d83a2f0a1407900d41708b9

                                        SHA1

                                        cb82ff17d4769d3d853f4d463b11631d67e11927

                                        SHA256

                                        c87a8c7325a495d9edc181d0e192b20a415bd47e6f3de47f523c10eeb87e3486

                                        SHA512

                                        ebd7e3976dbeac1bc70c4b88194e8c52c8f57684008e86244466a92ef7908fa37b0f91e21a2a01f07d72e9a99529416a4d9cdece524300c99a7b401371891566

                                      • C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat

                                        Filesize

                                        229B

                                        MD5

                                        bb153da09d97d3bb91c49d7207ef3a54

                                        SHA1

                                        89f2ba1a23be07736b98fd32728bec0e2c1ff9ac

                                        SHA256

                                        91c7e540e468824224414d5547bceb863465eae55aa486e2ebbe71d11ef89458

                                        SHA512

                                        51fbbae84fab4d7feb74a4d754057e6b29cc2f5181115a727c52b918e70c1d93a293b9a0b76ab2b903f82632216507edcd745b46e67b0a1c0d4cac22a4cb0d51

                                      • C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat

                                        Filesize

                                        229B

                                        MD5

                                        6ebbe7e4597ee1ac63aa8098c854871e

                                        SHA1

                                        28edd3da39939f3d72b57bca3b1eedee366bb19f

                                        SHA256

                                        6181236d6b9f59fbe9e723704c538cb9ccded99381564a1e3dea97443d124eca

                                        SHA512

                                        ba3e7fe314e94d2496a61e5442b16f299a3dfe55d1be073c791677d580703bf96a60d5771cc7a172c71e0212bd4af06c44b8d6176f2dd421296fc786eb9ec833

                                      • C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat

                                        Filesize

                                        229B

                                        MD5

                                        f6d0df28ab710107eec630554477f870

                                        SHA1

                                        f474882f9e5f6af2d07f8ef1d1a7249baa79b619

                                        SHA256

                                        ac9d179975e449326f036c8cc97c08f2c5d091e8e53ed3ec1074f0e308d55a28

                                        SHA512

                                        fe171f580b6a761faf8bac7e7ee44c2e39c4bafaf817ee058cb0e2cbee0c00fc9fcf4ca917094dc6fcd08311fd5a1f3436931068e25efb71cbc80a637d74b683

                                      • C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat

                                        Filesize

                                        229B

                                        MD5

                                        f6d0df28ab710107eec630554477f870

                                        SHA1

                                        f474882f9e5f6af2d07f8ef1d1a7249baa79b619

                                        SHA256

                                        ac9d179975e449326f036c8cc97c08f2c5d091e8e53ed3ec1074f0e308d55a28

                                        SHA512

                                        fe171f580b6a761faf8bac7e7ee44c2e39c4bafaf817ee058cb0e2cbee0c00fc9fcf4ca917094dc6fcd08311fd5a1f3436931068e25efb71cbc80a637d74b683

                                      • C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat

                                        Filesize

                                        229B

                                        MD5

                                        c6125cca99ca190feaa89096df41104f

                                        SHA1

                                        84900d87d80e262acbc0944c6d531fa5d6d2819a

                                        SHA256

                                        a958fed4ed5491a642f90033e158ed6cc62471120e1bf495db310325364d6ae9

                                        SHA512

                                        c046c9bfa7b7db51c605fb31d3f8bcb4eb130cbd0d9965f9dcf9301d969741759efd0f13198742b8c4bb1234358c7378f7cb628921923f33110fd10ff4a4d966

                                      • C:\Users\Admin\AppData\Local\Temp\kM739AVLL2.bat

                                        Filesize

                                        229B

                                        MD5

                                        5d1f40bd75b95662611c31c9151a4c77

                                        SHA1

                                        bba9c766c26e012ba5b5bb73f8d585cdb578484f

                                        SHA256

                                        4b6a073fa16546ca44acdc485f3eda842dbc96abf453de3cf33d0fb808e9dbed

                                        SHA512

                                        dfa145187d6d2b2fdfdc969c2a0a4524b360fff213acbd93c03e032f4422c374f263f164bdb62656ac0c4c4669c9024a95f54bbc563529fbbf1edefb9f9253b7

                                      • C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

                                        Filesize

                                        229B

                                        MD5

                                        d09466e0285b6cd414ceed5343a74bef

                                        SHA1

                                        8a34ac5a318e5b6515e7d919b32e7f18be68d41a

                                        SHA256

                                        d2f4f4ab3f5469e342c634e50a55972fc84907be4c50561edab9b22a30dd7b87

                                        SHA512

                                        31146707acd22a0e5ed492836c0517900bee8d22751e7faede086abc748ec3ec5235afccaa2dad8d3323b05cb83d3314d523b1708359fb17f3e782c08f9d76aa

                                      • C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat

                                        Filesize

                                        229B

                                        MD5

                                        bf87696a02769a7afa8f027a246e6feb

                                        SHA1

                                        ba9f71d3a81edf2031114fa1980233db897ba683

                                        SHA256

                                        7c3199ad0ea51e46fd7f6a6da5d739c29eac0fb8c8a881694e3d98213582e996

                                        SHA512

                                        298ba7c04c9955a653521102311e0311600b1684bae6d43254d4343fcd54a24e5b2688f1fd44defc59fa64e71603f518a657ab57e8dce16523c35cae235b1687

                                      • C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat

                                        Filesize

                                        229B

                                        MD5

                                        6159ade6e45602a0c7011b2083dd4cb5

                                        SHA1

                                        51337c8bace666de3acbf7c65890fe0d7fe21c74

                                        SHA256

                                        11c2933963a071ea4d0300b89d73f93a4619cbacb3144b6a5ef4aa511aa4b520

                                        SHA512

                                        5d323f78c67b872dcec905f15808b0b47c134c86bada6d44fb95332f6e1c879b1fd04de77a174a7d6832f77d0a4da5d67174a70e3e4fbcd884b6c039e767ab05

                                      • C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat

                                        Filesize

                                        229B

                                        MD5

                                        24a3cb63391658481deff807d7c689da

                                        SHA1

                                        e6ad32080416eb47cb9f227dd49106d672a37d1b

                                        SHA256

                                        08083a5534dfc5c046c99ce2b024d35fe850c14c80601c56d1c421f8ec79f0b8

                                        SHA512

                                        0ac618b3457616d95bc39e13383d0bb680951f5d66c7140e4408463e60a379e9147889a956aad2d9a0b4f67e06b287218924a1c38863117fa2eb81171d066f3d

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/68-366-0x000001D51B780000-0x000001D51B7A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/196-908-0x0000000001550000-0x0000000001562000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2280-282-0x00000000007F0000-0x0000000000900000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2280-286-0x00000000010D0000-0x00000000010DC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2280-285-0x00000000010C0000-0x00000000010CC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2280-284-0x00000000010E0000-0x00000000010EC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2280-283-0x00000000010B0000-0x00000000010C2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2976-155-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-150-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-167-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-165-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-164-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-166-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-168-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-169-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-170-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-171-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-163-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-162-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-179-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-178-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-161-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-117-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-118-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-173-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-160-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-116-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-177-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-119-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-159-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-176-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-158-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-157-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-175-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-156-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-121-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-172-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-154-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-153-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-152-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-174-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-151-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-122-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-149-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-148-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-147-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-146-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-145-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-144-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-143-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-142-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-141-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-140-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-139-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-138-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-137-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-136-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-135-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-134-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-133-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-132-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-124-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-131-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-130-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-129-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-128-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-127-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-126-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2976-125-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/4312-387-0x0000020766BF0000-0x0000020766C66000-memory.dmp

                                        Filesize

                                        472KB

                                      • memory/4376-181-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/4376-182-0x0000000077600000-0x000000007778E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/5664-885-0x0000000000930000-0x0000000000942000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/5844-891-0x00000000012B0000-0x00000000012C2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/6024-897-0x0000000001620000-0x0000000001632000-memory.dmp

                                        Filesize

                                        72KB