Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2023, 05:15

General

  • Target

    c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe

  • Size

    1.3MB

  • MD5

    19038d15cd39f252279d169394f84a5c

  • SHA1

    9aefcc105192fcc867b5af777e47c34190a3395e

  • SHA256

    c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2

  • SHA512

    13bacc77922b7ad8408bbe2ee869bed26a708ac26b7abe40784c205867b7f03b3bdfc9e96d2bbd0c624fbecb81430ff0cf1db961aba1466731d2f54eb9735e96

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe
    "C:\Users\Admin\AppData\Local\Temp\c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1328
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3468
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3680
          • C:\providercommon\DllCommonsvc.exe
            "C:\providercommon\DllCommonsvc.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4172
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
              6⤵
                PID:532
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2584
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:592
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\csrss.exe'
                6⤵
                  PID:2920
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\AvailableNetwork\powershell.exe'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2320
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\upfc.exe'
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2256
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\spoolsv.exe'
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2068
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:176
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\conhost.exe'
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3108
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3744
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3300
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'
                  6⤵
                    PID:3076
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7QhUsDoO8u.bat"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5004
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      7⤵
                        PID:4796
                      • C:\providercommon\DllCommonsvc.exe
                        "C:\providercommon\DllCommonsvc.exe"
                        7⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4900
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1752
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:604
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4348
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\explorer.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2920
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4388
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Registry.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4008
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3220
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\smss.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4316
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1912
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\WaaSMedicAgent.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:508
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2468
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4528
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3976
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\lsass.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:348
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2284
                        • C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe
                          "C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4408
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'
                      6⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1396
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
                      6⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2460
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SppExtComObj.exe'
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2316
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4256
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:2312
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:4612
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1592
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4400
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:204
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:228
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:4208
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2380
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
            1⤵
            • Process spawned unexpected child process
            PID:3180
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:4184
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3076
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\providercommon\lsass.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:5084
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4004
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:2104
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\odt\SppExtComObj.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2888
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:3944
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2308
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\serviced\csrss.exe'" /f
            1⤵
            • Process spawned unexpected child process
            PID:4228
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\csrss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2092
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\serviced\csrss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4176
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4680
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3436
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4592
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\providercommon\services.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4140
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4308
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4028
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:5044
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4972
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\upfc.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4404
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\upfc.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4964
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /f
            1⤵
            • Process spawned unexpected child process
            PID:4668
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1384
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:4296
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\upfc.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4880
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:4384
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4752
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:812
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1048
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2736
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4728
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:3776
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
            1⤵
            • Process spawned unexpected child process
            PID:4320
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4936
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4412
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4372
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4796
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3956
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4264
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4408
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3372
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsass.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2948
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3624
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:4416
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3568
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4240
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:348
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Registry.exe'" /f
            1⤵
            • Process spawned unexpected child process
            PID:4848
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Registry.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:532
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Registry.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            PID:2852
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\explorer.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2864
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Setup\State\explorer.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1676
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\State\explorer.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2600
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4400
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
            1⤵
              PID:2892
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
              1⤵
                PID:4296
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\odt\System.exe'" /f
                1⤵
                • Creates scheduled task(s)
                PID:3656
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
                1⤵
                  PID:2428
                • C:\Windows\system32\schtasks.exe
                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
                  1⤵
                  • Creates scheduled task(s)
                  PID:2308
                • C:\Windows\system32\schtasks.exe
                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'" /f
                  1⤵
                  • Creates scheduled task(s)
                  PID:4536
                • C:\Windows\system32\schtasks.exe
                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'" /rl HIGHEST /f
                  1⤵
                    PID:3436
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'" /rl HIGHEST /f
                    1⤵
                    • Creates scheduled task(s)
                    PID:4784
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\odt\smss.exe'" /f
                    1⤵
                      PID:3952
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
                      1⤵
                      • Creates scheduled task(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3076
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
                      1⤵
                        PID:2596
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dwm.exe'" /f
                        1⤵
                        • Creates scheduled task(s)
                        PID:3152
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                        1⤵
                        • Creates scheduled task(s)
                        PID:3908
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                        1⤵
                        • Creates scheduled task(s)
                        PID:2420
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /f
                        1⤵
                        • Creates scheduled task(s)
                        PID:3668
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
                        1⤵
                        • Creates scheduled task(s)
                        PID:1532
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
                        1⤵
                          PID:2544
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\WaaSMedicAgent.exe'" /f
                          1⤵
                          • Creates scheduled task(s)
                          PID:4916
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Public\Libraries\WaaSMedicAgent.exe'" /rl HIGHEST /f
                          1⤵
                          • Creates scheduled task(s)
                          PID:4508
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\WaaSMedicAgent.exe'" /rl HIGHEST /f
                          1⤵
                            PID:4340
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'" /f
                            1⤵
                            • Creates scheduled task(s)
                            PID:4856
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'" /rl HIGHEST /f
                            1⤵
                            • Creates scheduled task(s)
                            PID:4912
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'" /rl HIGHEST /f
                            1⤵
                            • Creates scheduled task(s)
                            PID:2228
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /f
                            1⤵
                              PID:4040
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Creates scheduled task(s)
                              PID:1256
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Creates scheduled task(s)
                              PID:2524
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\root\lsass.exe'" /f
                              1⤵
                                PID:4588
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\lsass.exe'" /rl HIGHEST /f
                                1⤵
                                  PID:3212
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\root\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                    PID:812

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                    Filesize

                                    1KB

                                    MD5

                                    7f3c0ae41f0d9ae10a8985a2c327b8fb

                                    SHA1

                                    d58622bf6b5071beacf3b35bb505bde2000983e3

                                    SHA256

                                    519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                    SHA512

                                    8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                    Filesize

                                    2KB

                                    MD5

                                    d85ba6ff808d9e5444a4b369f5bc2730

                                    SHA1

                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                    SHA256

                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                    SHA512

                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    d28a889fd956d5cb3accfbaf1143eb6f

                                    SHA1

                                    157ba54b365341f8ff06707d996b3635da8446f7

                                    SHA256

                                    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                    SHA512

                                    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    d28a889fd956d5cb3accfbaf1143eb6f

                                    SHA1

                                    157ba54b365341f8ff06707d996b3635da8446f7

                                    SHA256

                                    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                    SHA512

                                    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    d28a889fd956d5cb3accfbaf1143eb6f

                                    SHA1

                                    157ba54b365341f8ff06707d996b3635da8446f7

                                    SHA256

                                    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                    SHA512

                                    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    d28a889fd956d5cb3accfbaf1143eb6f

                                    SHA1

                                    157ba54b365341f8ff06707d996b3635da8446f7

                                    SHA256

                                    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                    SHA512

                                    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    2c30103cc6b103339cfe44137ca0edf0

                                    SHA1

                                    ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

                                    SHA256

                                    85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

                                    SHA512

                                    a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    2c30103cc6b103339cfe44137ca0edf0

                                    SHA1

                                    ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

                                    SHA256

                                    85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

                                    SHA512

                                    a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    2c30103cc6b103339cfe44137ca0edf0

                                    SHA1

                                    ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

                                    SHA256

                                    85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

                                    SHA512

                                    a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    1f38ffc35ea0800d3f212e4f40ccbb63

                                    SHA1

                                    ec0197998f685bc87317952230cc1a07801c6e24

                                    SHA256

                                    f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

                                    SHA512

                                    e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    1f38ffc35ea0800d3f212e4f40ccbb63

                                    SHA1

                                    ec0197998f685bc87317952230cc1a07801c6e24

                                    SHA256

                                    f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

                                    SHA512

                                    e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    1f38ffc35ea0800d3f212e4f40ccbb63

                                    SHA1

                                    ec0197998f685bc87317952230cc1a07801c6e24

                                    SHA256

                                    f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

                                    SHA512

                                    e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    1f38ffc35ea0800d3f212e4f40ccbb63

                                    SHA1

                                    ec0197998f685bc87317952230cc1a07801c6e24

                                    SHA256

                                    f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

                                    SHA512

                                    e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    1fa93386628f737393c1dd3ee35c90ab

                                    SHA1

                                    7602651fdf898d5d79cf1359419df3283afecae9

                                    SHA256

                                    98dfd16976b289ddb96da6ee11a3b025fb681926a63c5293c36ceb4a978bdf10

                                    SHA512

                                    5292d6d92f3ee576b2f443d576cf35f0cecf6bc8b55bdd85f0389f67491383e65b7ddf337ba679b11c9ed0f5f3b9a2a69214906845194f82301c9dab8c075814

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    64bd6b9cd961ecbab7b4879ef63b285e

                                    SHA1

                                    990d65d9f4509a3ef03e55355eda87e8a30325d0

                                    SHA256

                                    3b93e0887bec4c9becb9d0a235b6fbab86812fed1a365f1edfe9670255eeea86

                                    SHA512

                                    7c395824d1c4de1fef1fed15987f5654eb021f9c3335294811a0ea2f83cb751e518e494dd8a89ce8fefc6f7e6aaf77430090b45c46465b6b95343bfe347e0901

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    43bf8022fc868fa83e0f5535fb429e78

                                    SHA1

                                    a19c00d49cf7a0d3753f56ce90af3d2bb3ba8ade

                                    SHA256

                                    30271ddc31544d378f0ee313cc3cbe0d4f509b204a254989dc53a9463dbcbebe

                                    SHA512

                                    29c1e9025fe681a676daaecfeadd07cc5ce795b5a625f98c754ae5b4668d2444867bd20b84795176e82b1ec18e488e5542cb91ffda83324cf19d50bfb79bc642

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    be8f4a8468c0e7c25dcd243722a26bfa

                                    SHA1

                                    81dfb32c219bb2574499327cb5e9eb8fc90225b2

                                    SHA256

                                    a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

                                    SHA512

                                    db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    be8f4a8468c0e7c25dcd243722a26bfa

                                    SHA1

                                    81dfb32c219bb2574499327cb5e9eb8fc90225b2

                                    SHA256

                                    a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

                                    SHA512

                                    db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    39d4c9482986efe779d403696ccbdeec

                                    SHA1

                                    993a2bc07625fbc3afe1911f7ad420922c87ed21

                                    SHA256

                                    8303a9bbdb704ffa9fd6302468ed2d996752d1bbb19f06e16192cbf3d8d0e276

                                    SHA512

                                    7407faaa08010c3fdbe7e68bc1420c02c42de0e9284b8d8e4eff6fe6e9b4d7a1dc9e72431e57bc63a30c151f0040776357d3f18b79e4ceef6ef82733195485fb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    39d4c9482986efe779d403696ccbdeec

                                    SHA1

                                    993a2bc07625fbc3afe1911f7ad420922c87ed21

                                    SHA256

                                    8303a9bbdb704ffa9fd6302468ed2d996752d1bbb19f06e16192cbf3d8d0e276

                                    SHA512

                                    7407faaa08010c3fdbe7e68bc1420c02c42de0e9284b8d8e4eff6fe6e9b4d7a1dc9e72431e57bc63a30c151f0040776357d3f18b79e4ceef6ef82733195485fb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    39d4c9482986efe779d403696ccbdeec

                                    SHA1

                                    993a2bc07625fbc3afe1911f7ad420922c87ed21

                                    SHA256

                                    8303a9bbdb704ffa9fd6302468ed2d996752d1bbb19f06e16192cbf3d8d0e276

                                    SHA512

                                    7407faaa08010c3fdbe7e68bc1420c02c42de0e9284b8d8e4eff6fe6e9b4d7a1dc9e72431e57bc63a30c151f0040776357d3f18b79e4ceef6ef82733195485fb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    8b0fa5bb931381266db74160bf829cd5

                                    SHA1

                                    a09f7b0366d527e91e4e51c123fbe313dae2fc95

                                    SHA256

                                    3d3112fe048034402d17e26c4f214bb47570039c4bbd384574f454fc6120925b

                                    SHA512

                                    fe4f71f6883df1d5baa6d13e24e90000ed1a184ab968dbd4ebbaf6c854f05ab9da86e3602693da57bbb8997c15350b7b22bcc3a781a77a58beb60e478a7b2631

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    8b0fa5bb931381266db74160bf829cd5

                                    SHA1

                                    a09f7b0366d527e91e4e51c123fbe313dae2fc95

                                    SHA256

                                    3d3112fe048034402d17e26c4f214bb47570039c4bbd384574f454fc6120925b

                                    SHA512

                                    fe4f71f6883df1d5baa6d13e24e90000ed1a184ab968dbd4ebbaf6c854f05ab9da86e3602693da57bbb8997c15350b7b22bcc3a781a77a58beb60e478a7b2631

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    150616521d490e160cd33b97d678d206

                                    SHA1

                                    71594f5b97a4a61fe5f120eb10bcd6b73d7e6e78

                                    SHA256

                                    94595c05912cbb8380f7ed34499eb01fb91707a1ed1c02c02002a4361e889827

                                    SHA512

                                    7043dc4b336b1688205fbe762e731478ecaa0036c9f5e0434c79b8a6f8fa58b0705c8674fd6a047e6009edc52c37ce4e2ce81694e13b79a3e8183a32307f3815

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    07a7e9d768d519e36f65829f9d7afc21

                                    SHA1

                                    ed6833a1843b734937692d12890ebaba078b1d69

                                    SHA256

                                    1789df04b1ae1d74fc12c08479875c3d3fc7d11aad110ff109cebd06d64e7c82

                                    SHA512

                                    10a28789e8fe0f70c4ec3f991c58013a7c41c41eadbe5284e111922adef9e3e74e86094dc49ee60a8efd5d7c2a0293441fc08e14e8b38fad8a536931e17130db

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    07a7e9d768d519e36f65829f9d7afc21

                                    SHA1

                                    ed6833a1843b734937692d12890ebaba078b1d69

                                    SHA256

                                    1789df04b1ae1d74fc12c08479875c3d3fc7d11aad110ff109cebd06d64e7c82

                                    SHA512

                                    10a28789e8fe0f70c4ec3f991c58013a7c41c41eadbe5284e111922adef9e3e74e86094dc49ee60a8efd5d7c2a0293441fc08e14e8b38fad8a536931e17130db

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ef3321f9be72250ffc0d0de9c16b95b3

                                    SHA1

                                    95d76f8383c9a34e1c92a00e21e1d87cb3613fc7

                                    SHA256

                                    76a84e8bfa47d10786002ffeca42d9731f21c3f01b2e82aee28558e81e2550e9

                                    SHA512

                                    cb33aedfde3fbaf3be5a3aed0a50ab6b876cafe4c2141547f53d5e2e5520dda0ba5e773b6fc4be739edf639762581dd8fa7e0fafd4e55a3cdb5b4af6e2276326

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ef3321f9be72250ffc0d0de9c16b95b3

                                    SHA1

                                    95d76f8383c9a34e1c92a00e21e1d87cb3613fc7

                                    SHA256

                                    76a84e8bfa47d10786002ffeca42d9731f21c3f01b2e82aee28558e81e2550e9

                                    SHA512

                                    cb33aedfde3fbaf3be5a3aed0a50ab6b876cafe4c2141547f53d5e2e5520dda0ba5e773b6fc4be739edf639762581dd8fa7e0fafd4e55a3cdb5b4af6e2276326

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ef3321f9be72250ffc0d0de9c16b95b3

                                    SHA1

                                    95d76f8383c9a34e1c92a00e21e1d87cb3613fc7

                                    SHA256

                                    76a84e8bfa47d10786002ffeca42d9731f21c3f01b2e82aee28558e81e2550e9

                                    SHA512

                                    cb33aedfde3fbaf3be5a3aed0a50ab6b876cafe4c2141547f53d5e2e5520dda0ba5e773b6fc4be739edf639762581dd8fa7e0fafd4e55a3cdb5b4af6e2276326

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    0db76826ef1eb39b10f50c9c98411802

                                    SHA1

                                    88a49701de5a338400b3f5b40deb2608b413ab84

                                    SHA256

                                    f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

                                    SHA512

                                    0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    0db76826ef1eb39b10f50c9c98411802

                                    SHA1

                                    88a49701de5a338400b3f5b40deb2608b413ab84

                                    SHA256

                                    f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

                                    SHA512

                                    0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    0db76826ef1eb39b10f50c9c98411802

                                    SHA1

                                    88a49701de5a338400b3f5b40deb2608b413ab84

                                    SHA256

                                    f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

                                    SHA512

                                    0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    0db76826ef1eb39b10f50c9c98411802

                                    SHA1

                                    88a49701de5a338400b3f5b40deb2608b413ab84

                                    SHA256

                                    f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

                                    SHA512

                                    0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    de26a5cb0cd4ca07d7bee1975bceeed5

                                    SHA1

                                    0dd0b43296d5ee0acd18e578bef6073dde455a7d

                                    SHA256

                                    16d84f6ec4276b6dc7c22180abe1ed7a811776a5157378132fc2ff92b357b4ad

                                    SHA512

                                    01517bef84ce212d70a6e68a9f7b317f0e853c563a7ad4669b63c92dcf15404142fc4d8d1b4467960e3c963f5c0f621c541126f38c287b69d3c6b32266b39e66

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    29bea33ff17a4571d3fabb98854bda0a

                                    SHA1

                                    ae53e2a06f1ed61b5cc2ea78910270f21e9089ed

                                    SHA256

                                    72bc1e8f2a35b451e8b786e97a551e0826b7aa505a1520cff31f60c5377215b8

                                    SHA512

                                    fa244f1d02a27c14d19e08fb69eb6435fdef7b381d1fda351e5dd6d7ca8c8e23b947aeac8bd5b92a21cb36592ca239a86de2e22eadf6800fa4142ed1c17fc4d3

                                  • C:\Users\Admin\AppData\Local\Temp\7QhUsDoO8u.bat

                                    Filesize

                                    199B

                                    MD5

                                    5e360cff2f7754c27df1f59d9349ac23

                                    SHA1

                                    30c28822163af021a034b698939d69b28772d356

                                    SHA256

                                    d97819976aa579d950a33db79a9cb3ec21a7ec66c33fb4cbbf4a69f303c6b9f4

                                    SHA512

                                    df4c06c8136d1e04007f0cdec7e3c3514c3f00f2f2d8ff29f567e82edfcde9b3a5bf442c5c9481ca5bba444c8c1d6d1f961fe38c9b365dfdd8b6f61288566946

                                  • C:\providercommon\1zu9dW.bat

                                    Filesize

                                    36B

                                    MD5

                                    6783c3ee07c7d151ceac57f1f9c8bed7

                                    SHA1

                                    17468f98f95bf504cc1f83c49e49a78526b3ea03

                                    SHA256

                                    8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                    SHA512

                                    c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                  • C:\providercommon\6203df4a6bafc7

                                    Filesize

                                    420B

                                    MD5

                                    3e0aa8f5472b9706acf37014a2b2a0bc

                                    SHA1

                                    7d0f7d54339f2fc96a75976c9b07d5825d92f378

                                    SHA256

                                    df48a4408cac4d12885c4d9c0a6967b784b28a9283eb6d1b2ba84830a8881a90

                                    SHA512

                                    1247b8946bea867b1b7e8bd21bf768977b2e736327402aed650c93e8ab192f3f51bd8ce121a58a683ec75752fa6601977bbf745ba2b194205cd8a276a0074aac

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\c5b4cb5e9653cc

                                    Filesize

                                    312B

                                    MD5

                                    4ea03d3e0ec9a1500cf976736473541c

                                    SHA1

                                    e3563c341f814f2e67e999011f8f72332f0f4a36

                                    SHA256

                                    bfc3f0cdb6065578f020d245f7201a03d3cb4fbbf1751671aeab1bf813b3c702

                                    SHA512

                                    5384dda4789cf8e99a8b4a35485668a4e95fe34c501ab3009504dc31ef536b3f00f88c48f4021933032bc014c59163258f9785a20ba93b6a5e53af1597030aab

                                  • C:\providercommon\lsass.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\services.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                    Filesize

                                    197B

                                    MD5

                                    8088241160261560a02c84025d107592

                                    SHA1

                                    083121f7027557570994c9fc211df61730455bb5

                                    SHA256

                                    2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                    SHA512

                                    20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                  • memory/176-216-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/176-192-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/348-270-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/508-266-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/532-180-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/532-202-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/592-203-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/592-182-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/604-251-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1328-139-0x0000000000450000-0x0000000000560000-memory.dmp

                                    Filesize

                                    1.1MB

                                  • memory/1328-147-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1328-226-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1396-221-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1396-188-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1752-268-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1752-248-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1912-263-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2068-197-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2068-189-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2256-218-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2256-191-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2284-269-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2316-183-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2316-209-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2320-207-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2320-186-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2460-187-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2460-214-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2468-264-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2468-273-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2584-199-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2584-181-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2920-255-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2920-211-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2920-185-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3076-210-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3076-196-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3108-193-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3108-224-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3220-259-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3260-160-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3260-148-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3300-195-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3300-225-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3468-146-0x000001DAB7850000-0x000001DAB7872000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/3468-151-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3468-158-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3680-157-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3680-149-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3744-194-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3744-222-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3976-261-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4008-253-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4172-152-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4172-179-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4316-262-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4348-252-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4388-159-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4388-150-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4388-258-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4408-265-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4528-267-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4900-260-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4900-231-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

                                    Filesize

                                    10.8MB