dcrat | 6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab

Analysis

max time kernel
298s
max time network
302s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
18/07/2023, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe
Size

1.3MB
MD5

3764c06ec23c8c42305b66b60e2559d9
SHA1

81f8db6cbf22dae3a02aa364db470f40b163b624
SHA256

6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab
SHA512

2d912efd97f9ac860005c82c92d0c497940eb92c143ed486c1ffcce8751d9e7052132ba49dabdf31dada1e6693acc91dc07eebe5336d10f1996a5c66001f2139
SSDEEP

24576:U2G/nvxW3Ww0t3rZDceHt0L3/LoiXbt6R62BNerH5YVrb:UbA303rxceHaLv36UkvVr

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	192	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	164	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	96	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	200	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4420	schtasks.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	4420	schtasks.exe	74

DCRat payload 24 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000001aff9-128.dat	dcrat
behavioral2/files/0x000700000001aff9-130.dat	dcrat
behavioral2/memory/3220-131-0x0000000000F90000-0x00000000010A0000-memory.dmp	dcrat
behavioral2/files/0x000600000001affe-140.dat	dcrat
behavioral2/files/0x000600000001b012-474.dat	dcrat
behavioral2/files/0x000600000001b012-473.dat	dcrat
behavioral2/files/0x000600000001b012-1170.dat	dcrat
behavioral2/files/0x000600000001b012-1262.dat	dcrat
behavioral2/files/0x000600000001b012-1271.dat	dcrat
behavioral2/files/0x000600000001b012-1280.dat	dcrat
behavioral2/files/0x000600000001b012-1289.dat	dcrat
behavioral2/files/0x000600000001b012-1298.dat	dcrat
behavioral2/files/0x000600000001b012-1307.dat	dcrat
behavioral2/files/0x000600000001b012-1316.dat	dcrat
behavioral2/files/0x000600000001b012-1325.dat	dcrat
behavioral2/files/0x000600000001b012-1334.dat	dcrat
behavioral2/files/0x000600000001b012-1343.dat	dcrat
behavioral2/files/0x000600000001b012-1352.dat	dcrat
behavioral2/files/0x000600000001b012-1362.dat	dcrat
behavioral2/files/0x000600000001b012-1371.dat	dcrat
behavioral2/files/0x000600000001b012-1380.dat	dcrat
behavioral2/files/0x000600000001b012-1389.dat	dcrat
behavioral2/files/0x000600000001b012-1400.dat	dcrat
behavioral2/files/0x000600000001b012-1410.dat	dcrat

Executes dropped EXE 23 IoCs

pid	Process
3220	PortcontainerHost.exe
5868	sihost.exe
5356	sihost.exe
5648	sihost.exe
2912	sihost.exe
3860	sihost.exe
5972	sihost.exe
4336	sihost.exe
1744	sihost.exe
3684	sihost.exe
5436	sihost.exe
5584	sihost.exe
1132	sihost.exe
2940	sihost.exe
5304	sihost.exe
5616	sihost.exe
3740	sihost.exe
5640	sihost.exe
3732	sihost.exe
424	sihost.exe
5844	sihost.exe
5860	sihost.exe
4448	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\7a0fd90576e088	PortcontainerHost.exe
File created	C:\Program Files\Java\smss.exe	PortcontainerHost.exe
File created	C:\Program Files\Java\69ddcba757bf72	PortcontainerHost.exe
File created	C:\Program Files\Microsoft Office\Office16\fontdrvhost.exe	PortcontainerHost.exe
File created	C:\Program Files\Microsoft Office\Office16\5b884080fd4f94	PortcontainerHost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe	PortcontainerHost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe	PortcontainerHost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\ea9f0e6c9e2dcd	PortcontainerHost.exe
File created	C:\Program Files (x86)\Common Files\Services\Idle.exe	PortcontainerHost.exe
File created	C:\Program Files (x86)\Common Files\Services\6ccacd8608530f	PortcontainerHost.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\OfficeClickToRun.exe	PortcontainerHost.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\e6c9b481da804f	PortcontainerHost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\System\wininit.exe	PortcontainerHost.exe
File created	C:\Windows\Vss\Writers\System\56085415360792	PortcontainerHost.exe
File created	C:\Windows\en-US\explorer.exe	PortcontainerHost.exe
File created	C:\Windows\en-US\7a0fd90576e088	PortcontainerHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4552	schtasks.exe
4456	schtasks.exe
4544	schtasks.exe
4904	schtasks.exe
2656	schtasks.exe
4988	schtasks.exe
4360	schtasks.exe
1256	schtasks.exe
4000	schtasks.exe
3532	schtasks.exe
4860	schtasks.exe
4252	schtasks.exe
4344	schtasks.exe
1032	schtasks.exe
2916	schtasks.exe
200	schtasks.exe
4984	schtasks.exe
868	schtasks.exe
2496	schtasks.exe
96	schtasks.exe
2808	schtasks.exe
924	schtasks.exe
4052	schtasks.exe
2016	schtasks.exe
1860	schtasks.exe
3692	schtasks.exe
1704	schtasks.exe
4388	schtasks.exe
2272	schtasks.exe
4812	schtasks.exe
192	schtasks.exe
4800	schtasks.exe
4740	schtasks.exe
1248	schtasks.exe
2780	schtasks.exe
308	schtasks.exe
4836	schtasks.exe
2300	schtasks.exe
4496	schtasks.exe
3264	schtasks.exe
376	schtasks.exe
2712	schtasks.exe
2192	schtasks.exe
164	schtasks.exe
4784	schtasks.exe
3588	schtasks.exe
1924	schtasks.exe
2136	schtasks.exe
576	schtasks.exe
4316	schtasks.exe
2196	schtasks.exe
4512	schtasks.exe
4932	schtasks.exe
4076	schtasks.exe
2168	schtasks.exe
2500	schtasks.exe
5028	schtasks.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	PortcontainerHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3220	PortcontainerHost.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3188	powershell.exe
3188	powershell.exe
3188	powershell.exe
3860	powershell.exe
3860	powershell.exe
3188	powershell.exe
2448	powershell.exe
2448	powershell.exe
4484	powershell.exe
4484	powershell.exe
2564	powershell.exe
2564	powershell.exe
2820	powershell.exe
2820	powershell.exe
3668	powershell.exe
3668	powershell.exe
4624	powershell.exe
4624	powershell.exe
580	powershell.exe
580	powershell.exe
4504	powershell.exe
3860	powershell.exe
2472	powershell.exe
2472	powershell.exe
4504	powershell.exe
4380	powershell.exe
4380	powershell.exe
4044	powershell.exe
4044	powershell.exe
4816	powershell.exe
4816	powershell.exe
2568	powershell.exe
2568	powershell.exe
484	powershell.exe
484	powershell.exe
1972	powershell.exe
1972	powershell.exe
2448	powershell.exe
4484	powershell.exe
3108	powershell.exe
3108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	PortcontainerHost.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeIncreaseQuotaPrivilege	3360	powershell.exe
Token: SeSecurityPrivilege	3360	powershell.exe
Token: SeTakeOwnershipPrivilege	3360	powershell.exe
Token: SeLoadDriverPrivilege	3360	powershell.exe
Token: SeSystemProfilePrivilege	3360	powershell.exe
Token: SeSystemtimePrivilege	3360	powershell.exe
Token: SeProfSingleProcessPrivilege	3360	powershell.exe
Token: SeIncBasePriorityPrivilege	3360	powershell.exe
Token: SeCreatePagefilePrivilege	3360	powershell.exe
Token: SeBackupPrivilege	3360	powershell.exe
Token: SeRestorePrivilege	3360	powershell.exe
Token: SeShutdownPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeSystemEnvironmentPrivilege	3360	powershell.exe
Token: SeRemoteShutdownPrivilege	3360	powershell.exe
Token: SeUndockPrivilege	3360	powershell.exe
Token: SeManageVolumePrivilege	3360	powershell.exe
Token: 33	3360	powershell.exe
Token: 34	3360	powershell.exe
Token: 35	3360	powershell.exe
Token: 36	3360	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	5868	sihost.exe
Token: SeIncreaseQuotaPrivilege	3188	powershell.exe
Token: SeSecurityPrivilege	3188	powershell.exe
Token: SeTakeOwnershipPrivilege	3188	powershell.exe
Token: SeLoadDriverPrivilege	3188	powershell.exe
Token: SeSystemProfilePrivilege	3188	powershell.exe
Token: SeSystemtimePrivilege	3188	powershell.exe
Token: SeProfSingleProcessPrivilege	3188	powershell.exe
Token: SeIncBasePriorityPrivilege	3188	powershell.exe
Token: SeCreatePagefilePrivilege	3188	powershell.exe
Token: SeBackupPrivilege	3188	powershell.exe
Token: SeRestorePrivilege	3188	powershell.exe
Token: SeShutdownPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeSystemEnvironmentPrivilege	3188	powershell.exe
Token: SeRemoteShutdownPrivilege	3188	powershell.exe
Token: SeUndockPrivilege	3188	powershell.exe
Token: SeManageVolumePrivilege	3188	powershell.exe
Token: 33	3188	powershell.exe
Token: 34	3188	powershell.exe
Token: 35	3188	powershell.exe
Token: 36	3188	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 756	1124	6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe	70
PID 1124 wrote to memory of 756	1124	6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe	70
PID 1124 wrote to memory of 756	1124	6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe	70
PID 756 wrote to memory of 3036	756	WScript.exe	71
PID 756 wrote to memory of 3036	756	WScript.exe	71
PID 756 wrote to memory of 3036	756	WScript.exe	71
PID 3036 wrote to memory of 3220	3036	cmd.exe	73
PID 3036 wrote to memory of 3220	3036	cmd.exe	73
PID 3220 wrote to memory of 4624	3220	PortcontainerHost.exe	132
PID 3220 wrote to memory of 4624	3220	PortcontainerHost.exe	132
PID 3220 wrote to memory of 3360	3220	PortcontainerHost.exe	133
PID 3220 wrote to memory of 3360	3220	PortcontainerHost.exe	133
PID 3220 wrote to memory of 3188	3220	PortcontainerHost.exe	134
PID 3220 wrote to memory of 3188	3220	PortcontainerHost.exe	134
PID 3220 wrote to memory of 4504	3220	PortcontainerHost.exe	135
PID 3220 wrote to memory of 4504	3220	PortcontainerHost.exe	135
PID 3220 wrote to memory of 2820	3220	PortcontainerHost.exe	136
PID 3220 wrote to memory of 2820	3220	PortcontainerHost.exe	136
PID 3220 wrote to memory of 3108	3220	PortcontainerHost.exe	137
PID 3220 wrote to memory of 3108	3220	PortcontainerHost.exe	137
PID 3220 wrote to memory of 1972	3220	PortcontainerHost.exe	138
PID 3220 wrote to memory of 1972	3220	PortcontainerHost.exe	138
PID 3220 wrote to memory of 4484	3220	PortcontainerHost.exe	139
PID 3220 wrote to memory of 4484	3220	PortcontainerHost.exe	139
PID 3220 wrote to memory of 580	3220	PortcontainerHost.exe	140
PID 3220 wrote to memory of 580	3220	PortcontainerHost.exe	140
PID 3220 wrote to memory of 4044	3220	PortcontainerHost.exe	141
PID 3220 wrote to memory of 4044	3220	PortcontainerHost.exe	141
PID 3220 wrote to memory of 484	3220	PortcontainerHost.exe	173
PID 3220 wrote to memory of 484	3220	PortcontainerHost.exe	173
PID 3220 wrote to memory of 3668	3220	PortcontainerHost.exe	172
PID 3220 wrote to memory of 3668	3220	PortcontainerHost.exe	172
PID 3220 wrote to memory of 3860	3220	PortcontainerHost.exe	171
PID 3220 wrote to memory of 3860	3220	PortcontainerHost.exe	171
PID 3220 wrote to memory of 2448	3220	PortcontainerHost.exe	170
PID 3220 wrote to memory of 2448	3220	PortcontainerHost.exe	170
PID 3220 wrote to memory of 2472	3220	PortcontainerHost.exe	142
PID 3220 wrote to memory of 2472	3220	PortcontainerHost.exe	142
PID 3220 wrote to memory of 4440	3220	PortcontainerHost.exe	166
PID 3220 wrote to memory of 4440	3220	PortcontainerHost.exe	166
PID 3220 wrote to memory of 4816	3220	PortcontainerHost.exe	165
PID 3220 wrote to memory of 4816	3220	PortcontainerHost.exe	165
PID 3220 wrote to memory of 2564	3220	PortcontainerHost.exe	164
PID 3220 wrote to memory of 2564	3220	PortcontainerHost.exe	164
PID 3220 wrote to memory of 2568	3220	PortcontainerHost.exe	163
PID 3220 wrote to memory of 2568	3220	PortcontainerHost.exe	163
PID 3220 wrote to memory of 4380	3220	PortcontainerHost.exe	162
PID 3220 wrote to memory of 4380	3220	PortcontainerHost.exe	162
PID 3220 wrote to memory of 5068	3220	PortcontainerHost.exe	154
PID 3220 wrote to memory of 5068	3220	PortcontainerHost.exe	154
PID 5068 wrote to memory of 4812	5068	cmd.exe	174
PID 5068 wrote to memory of 4812	5068	cmd.exe	174
PID 5068 wrote to memory of 5868	5068	cmd.exe	176
PID 5068 wrote to memory of 5868	5068	cmd.exe	176
PID 5868 wrote to memory of 3084	5868	sihost.exe	182
PID 5868 wrote to memory of 3084	5868	sihost.exe	182
PID 3084 wrote to memory of 6116	3084	Conhost.exe	179
PID 3084 wrote to memory of 6116	3084	Conhost.exe	179
PID 3084 wrote to memory of 5356	3084	Conhost.exe	180
PID 3084 wrote to memory of 5356	3084	Conhost.exe	180
PID 5356 wrote to memory of 1080	5356	sihost.exe	181
PID 5356 wrote to memory of 1080	5356	sihost.exe	181
PID 1080 wrote to memory of 5512	1080	cmd.exe	183
PID 1080 wrote to memory of 5512	1080	cmd.exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe
"C:\Users\Admin\AppData\Local\Temp\6d1414a6e1a8ee5a4201c5ce6be22e3c660b329e3fd686845047f97980bfdaab.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\PortrefHostnetdhcp\hnwaZdn68w0TGMITAOZTO.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\PortrefHostnetdhcp\ETJ15A7MdhSmTzkpI.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\PortrefHostnetdhcp\PortcontainerHost.exe
      "C:\PortrefHostnetdhcp\PortcontainerHost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\PortcontainerHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\Java\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortrefHostnetdhcp\ApplicationFrameHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4Hfxxo0Tw3.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5068
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4812
      - C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qzqLwOyuSO.bat"
        7⤵
        
        PID:3084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:6116
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UQ4uSu8U9J.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5512
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat"
        11⤵
        
        PID:5856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2232
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat"
        13⤵
        
        PID:4748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2452
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QY0o5k1hVk.bat"
        15⤵
        
        PID:1104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:6044
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat"
        17⤵
        
        PID:3624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:8
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t6OOvELCCF.bat"
        19⤵
        
        PID:4740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4868
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X5jGqiFaSS.bat"
        21⤵
        
        PID:4196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4048
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat"
        23⤵
        
        PID:4984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2500
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat"
        25⤵
        
        PID:3776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4208
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xm2kK1SIVO.bat"
        27⤵
        
        PID:5380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:5800
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat"
        29⤵
        
        PID:4836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3800
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat"
        31⤵
        
        PID:4192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:5764
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ldsg1wMto.bat"
        33⤵
        
        PID:4104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:5832
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat"
        35⤵
        
        PID:4100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        36⤵
        
        PID:4784
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        37⤵
        
        PID:5924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        38⤵
        
        PID:4996
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        39⤵
        
        PID:3216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        40⤵
        
        PID:868
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qqpXlQnQd1.bat"
        41⤵
        
        PID:1104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        42⤵
        
        PID:4420
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wtOcRLEbie.bat"
        43⤵
        
        PID:5232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        44⤵
        
        PID:5412
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
        45⤵
        
        PID:5036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        46⤵
        
        PID:5976
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat"
        47⤵
        
        PID:1656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        48⤵
        
        PID:5324
        
        C:\odt\sihost.exe
        
        "C:\odt\sihost.exe"
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9j3rBUpSkc.bat"
        49⤵
        
        PID:3536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        50⤵
        
        PID:3112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhostw.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\PortrefHostnetdhcp\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\PortrefHostnetdhcp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\PortrefHostnetdhcp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Oracle\Java\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Oracle\Java\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\odt\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 12 /tr "'C:\PortrefHostnetdhcp\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\PortrefHostnetdhcp\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\PortrefHostnetdhcp\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Services\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:96

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 13 /tr "'C:\PortrefHostnetdhcp\ApplicationFrameHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\PortrefHostnetdhcp\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 9 /tr "'C:\PortrefHostnetdhcp\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Application Data\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office16\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\Office16\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortrefHostnetdhcp\ETJ15A7MdhSmTzkpI.bat

Filesize
45B

MD5
a1015752e9451d4a39d23d12d6ab9298

SHA1
5791a577cae9ae7859fac2de03e3603f4c1c928a

SHA256
02b58b7a916b7bf49e2ad2e6a49256f7a3ee6294276e3892b221d0b6ebaa96e4

SHA512
64302aef161853b57c4756020fbbf5e22905c3b9ad7491ea277a6fd1518ce1cd61a4f0b3d7b5d23ff747927d1ef1ec55d22e1e544f2866498a08bb0b5a8273c6

Download Submit
C:\PortrefHostnetdhcp\PortcontainerHost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\PortrefHostnetdhcp\PortcontainerHost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\PortrefHostnetdhcp\hnwaZdn68w0TGMITAOZTO.vbe

Filesize
212B

MD5
bde97ed07894e00778b57a73d72bca2d

SHA1
b3605af19aacee441a720f6ee869411e817b5bcc

SHA256
a1cb8fd63b500692c499bf765334778b4cda2603d62b9964d6e8cca3178cb38e

SHA512
b9acf4642e19f64e9611d2fa18101473589999cd10041b27013e295e72e07754d6ed2990ec51dde1f83ff5ebc66f134bc4c19f0a10d9cf1b684f7b06b2d22404

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\explorer.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fa366de96c6a8b5fa476a522d53296c5

SHA1
327cb5c81735f30b5d41a8ed9b469aff827227e9

SHA256
84a1fa9bf57ff953b568802272747a3f8749678da78cd3b3ad3ae7a6d19caf22

SHA512
f93a42a1222f55c2f5456f9577d6bb88442ce12897025a0e72665a39eaa303679d9417e7f0269f07433d1b62edca52c8c9d554c630f56c31cfb7596638e44c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9fb8e485a202d28a1a374ba6af39b2fb

SHA1
15e1794a859fc5ff0ec022026a4ecc062df8f252

SHA256
61cfb6a71b2a98e8a4fad7af0d89955e206634f3eeb0bbf5005db1ce07c8805f

SHA512
daccd31f3bd8d09f668b29f05d253820048f3a4c48e4ba5c7dde7e6eab6072e2f4ff4ce88519d23b9ee682fbacdd893a13e21f6ee4f897838bdc1f9570eb6afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9028b6ee9921757a1070d0b2fb06e33a

SHA1
8d468f6af8ca33b36517d69f9e5a84971b76d38e

SHA256
c0a9111784367b2278c83e99572908d373b2331073e15eea8b5021ede06f678a

SHA512
a2988531d6d202dd865e496fdfa2923864889dc4a7e633b9a867596958af9b97132234acca99ccf95d506302994bbd30e378e53da3855dec22450992e954ec11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2c2b940988d1b52ea721fe23d4219f59

SHA1
6cecbe6cf36fde2729c81903ff92b8bd46f5c50d

SHA256
74056737a14b44ae138b3f13fcc45f86b311bf47f6bbe8486a4185c4b720c450

SHA512
31ba2532317473b532711ebb04ec7b6bb067fe8fc99dcd2dc9cc500068c169bfc59e605aa71922aef345c17805cba536434e2e525f2727da85b1fcaff085a3a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
00914932155967c851d0d5601a04ff5f

SHA1
8a745246522d6209daada135dc47c8b3a4150c0e

SHA256
e856c089f2e735f2fe8922cd0ca9c4be3b6af6de2dd86fad4121577d02ab48de

SHA512
4b35bd84db93ef7fdfb3032f4f45456d6258e08a76b3defd3bc27e0621a5a4f856326c825de79637ec8614d1fdcb717c0e698882d58ec9d6ba29108d10040df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
00914932155967c851d0d5601a04ff5f

SHA1
8a745246522d6209daada135dc47c8b3a4150c0e

SHA256
e856c089f2e735f2fe8922cd0ca9c4be3b6af6de2dd86fad4121577d02ab48de

SHA512
4b35bd84db93ef7fdfb3032f4f45456d6258e08a76b3defd3bc27e0621a5a4f856326c825de79637ec8614d1fdcb717c0e698882d58ec9d6ba29108d10040df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
18dd33a64e8c6914801aabe2faf3fd3e

SHA1
a34e0570f4e609c206a9d311d05acdd375e65651

SHA256
f37365720829a9f75f684152209851d8511d3914e3be73709ebf8f380cc145c4

SHA512
19d056f79625f400762ee21c08f57782d484e9af7df116b12cd346c29adcd3fcb2d9edec063272f1f7637c79a57c10461ea0ebe185651993fa9aa6e80c418655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d9b4fee19fd36789377ab47146a3d23f

SHA1
0324033047a8c05066c936cc92def1ae60a9345b

SHA256
4a812a316bf8d9afec4c73efb93a83d8d4d0bcb480685b8f3adb5d84b3fa8d9a

SHA512
db06d6845a9b4d91650480bcd9ee6bc0f59b09024aa45bbd014f7ca1a9086227676cbcfc1fa5d8ad0fb7aaef2e51784fe35e33398a1c76484806c8a5365c79ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8e9a7e960f5014144ff871ad11596642

SHA1
f9e68e64a43b09ed1169c72a622c882c4234cb01

SHA256
b4b5113a6a66cb3e8e4c4fbd0a44a7577630108d9d7715bb4d2bedde4b29386e

SHA512
1691ca52d9a5e324f1c70397d3519a4d47b98e84a0bb7e1fc88d448790961583a0d4130c2fba0fa263bf767a95920d83cca44d00e544d8ac29618dfd7c2432b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8e9a7e960f5014144ff871ad11596642

SHA1
f9e68e64a43b09ed1169c72a622c882c4234cb01

SHA256
b4b5113a6a66cb3e8e4c4fbd0a44a7577630108d9d7715bb4d2bedde4b29386e

SHA512
1691ca52d9a5e324f1c70397d3519a4d47b98e84a0bb7e1fc88d448790961583a0d4130c2fba0fa263bf767a95920d83cca44d00e544d8ac29618dfd7c2432b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8632d9fc4ab4672c0bcbd1fe249c4217

SHA1
b0eb590f261e510da5210f588fdba682df253b90

SHA256
98e9802f54d2b2f8b7a766e93c59b85dcd05ae01ef1340fcb23c26544fdf8e6e

SHA512
0b0f92dcf7f71d7428cbeab653a1db12a8f01fe478e6e797523614516804771e77822ffd3ad612f62f3a2f017fcd83bd17a1fdb1e6ba78c0c96b9fb17a705ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8632d9fc4ab4672c0bcbd1fe249c4217

SHA1
b0eb590f261e510da5210f588fdba682df253b90

SHA256
98e9802f54d2b2f8b7a766e93c59b85dcd05ae01ef1340fcb23c26544fdf8e6e

SHA512
0b0f92dcf7f71d7428cbeab653a1db12a8f01fe478e6e797523614516804771e77822ffd3ad612f62f3a2f017fcd83bd17a1fdb1e6ba78c0c96b9fb17a705ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8632d9fc4ab4672c0bcbd1fe249c4217

SHA1
b0eb590f261e510da5210f588fdba682df253b90

SHA256
98e9802f54d2b2f8b7a766e93c59b85dcd05ae01ef1340fcb23c26544fdf8e6e

SHA512
0b0f92dcf7f71d7428cbeab653a1db12a8f01fe478e6e797523614516804771e77822ffd3ad612f62f3a2f017fcd83bd17a1fdb1e6ba78c0c96b9fb17a705ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4c64b3c5591918fd88f5af4e9a4b8aa7

SHA1
2b410f14d9e5723e23c151e9b14a92502b0e6de7

SHA256
509187b9cf390b11b386612d11ad94d762c7b46e6fd975df8abdc9f091b24cf1

SHA512
5a04f457547b41652778bc43a49c01943edc64e0e25d0e670f818b37afa41cbd683d8b50f24445bda3d0725b3a000ae4c97f70befb45780b50af671f3384e765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4c64b3c5591918fd88f5af4e9a4b8aa7

SHA1
2b410f14d9e5723e23c151e9b14a92502b0e6de7

SHA256
509187b9cf390b11b386612d11ad94d762c7b46e6fd975df8abdc9f091b24cf1

SHA512
5a04f457547b41652778bc43a49c01943edc64e0e25d0e670f818b37afa41cbd683d8b50f24445bda3d0725b3a000ae4c97f70befb45780b50af671f3384e765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af5497454aed1a791213d094ccc8168c

SHA1
44b5487dc2c6ffdab6bd3ab0dce9dad6160e40c7

SHA256
145d781cfcc2602b144c8840e41e40708fa4fece9d5f57f98c284b6b22acc3ba

SHA512
c0bedd00bd633189da924e7369b59eddc03e1e681de01ecd699833f9244c16549d190315d6a8e6b0719ef24dd95d875c9f06f27563942ca0ce9bd7a9e38b42b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af5497454aed1a791213d094ccc8168c

SHA1
44b5487dc2c6ffdab6bd3ab0dce9dad6160e40c7

SHA256
145d781cfcc2602b144c8840e41e40708fa4fece9d5f57f98c284b6b22acc3ba

SHA512
c0bedd00bd633189da924e7369b59eddc03e1e681de01ecd699833f9244c16549d190315d6a8e6b0719ef24dd95d875c9f06f27563942ca0ce9bd7a9e38b42b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c43f9969831a080fb739252eb77b7c67

SHA1
8dc18238a905494ab27e19ae5a9559ffa40c39e3

SHA256
ecb8a7a58f499a2da8af4490a8b92f0368dcbc83256ae145484eaa90dc3c7842

SHA512
8174002b72086e982a83eb25544925738c8b31fb922d776ace1bc5d916fd5d19ae6aa182eb5ea855191f6c892ff79d0bf42a8d746b632f812df9c68435be6dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
54e687f1a7a4d11117d4abf659c2b3a6

SHA1
a60addd26fe7397f376f358ab64f769573fdf6b7

SHA256
ceac15ee245008690f05a4262c032617c16109376f0ad203250b16c9a1e06164

SHA512
079c085d490a684b799b6f7445a21ddb72189e426faa45a6827a3be217bbf846729eeead9279631595beb1a7f6369413b660c3471e32225cf68b2b24cb530860

Download Submit
C:\Users\Admin\AppData\Local\Temp\4Hfxxo0Tw3.bat

Filesize
182B

MD5
1d12b7bcc35407a8a58a1a04f5be8120

SHA1
33712d8fb64a909dcd044647818551dedab94559

SHA256
900543e9911849dd05fe056e9e53dec3f86d76d596e034e4239b1590e0e03881

SHA512
e4aa83d017282b04d8946f3cd7fbc996593605f18af9b66eb8b1b8402cd5690f21537799f31e17ee0fad05e37a5764bf047eeb1301f1e7a52929e4c9e5e5a06a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ldsg1wMto.bat

Filesize
182B

MD5
eaa96cb2913962f69fa87b406a342014

SHA1
2a62f18315b18833665ade9f00abedd04096558b

SHA256
40ac6ca58433be4cd89e7da313ff48c7ea3912c9aebf1afdcba1bfa6319240c0

SHA512
c2af1d7fd69b826960e99fe29f2abde6a713029ef2552e28608be56c2a9445b925ad146de33f59f9f2207fda08db37afefd06f14feb8156d0622d167920505b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat

Filesize
182B

MD5
df2b229f0fa4ec13bc1584965c69903f

SHA1
c8b64c808730d01af2a68dfc7a93ca5669ca6a8a

SHA256
52669966db25b98cb2a9b11bf8b0e3cc4136afccb2af3b4dd402a9a4238c5d53

SHA512
44d9740104ca8d464083d2b9176d0175bfae1a4e61e20eee553860d3a816db5b8192cf919a666fb47134e87a95d306766fb1e5c3e09c902c5676e72c8d403d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat

Filesize
182B

MD5
a6cee893a5f79d66ab3672c051b666d8

SHA1
c1ac29119f91cbf8004e9b6c057df107fe2927ea

SHA256
4f60461badf5048920ce45782b7d9a424a40ceb09dce0fe0d677f721d9a01ee9

SHA512
60c0c92979a1541192378aeae4520e860113a857392c642c9660e72dc23d757d7fd69098cd440a270d4c07d2bb46b4886734fd9859e1bbd635847deada5764a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat

Filesize
182B

MD5
60c8ce7a2603026776208b4ac5265135

SHA1
1d4711d6f6ac484ab5fa84271b6af3fbc74f8a5e

SHA256
4a8ecee362db10c3473b57ac0f887a5c4dc49ad585c6aa22daefd46ec54af63c

SHA512
7468a20fa058bd2c6c11af298a7c3206a1d36b77d7d2740dfae95d87a668d261a07921c5badd5492819813ab05c857501a14a071fbdde4b84ec77faa54ba0418

Download Submit
C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat

Filesize
182B

MD5
0c119a5addf10087ed8a3e962125d6c2

SHA1
207f357aa0f563be93ce026c0ad00c3ff6e711d4

SHA256
05fbb3f3ebd2e550ae90858e63ba71331e7b5822a244d4ac85eb84777bbd4f91

SHA512
032c3e143f177479b52b0bd453e1cdcd25eb75285e43f20d7b451fd704a1461e4234963f7f6735b6fd434680f97ba4f377954b9113db2c57a00ef2e9eb1da3d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat

Filesize
182B

MD5
0c119a5addf10087ed8a3e962125d6c2

SHA1
207f357aa0f563be93ce026c0ad00c3ff6e711d4

SHA256
05fbb3f3ebd2e550ae90858e63ba71331e7b5822a244d4ac85eb84777bbd4f91

SHA512
032c3e143f177479b52b0bd453e1cdcd25eb75285e43f20d7b451fd704a1461e4234963f7f6735b6fd434680f97ba4f377954b9113db2c57a00ef2e9eb1da3d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\QY0o5k1hVk.bat

Filesize
182B

MD5
cb30168a453271bc00b32508db378067

SHA1
d923501bdca9bdc40f4c4c19a8a51413279bac85

SHA256
ad03e839652465aa4e82cef82cd7946e94fa860f46d74a8e24bba5f8f638b5a3

SHA512
cad5667ea6328d5a9a355ad6aae4f3c5e88afe05b71dc8f099689dddffed90a541f8e3591fe55451dccb05166c3888f0e6163f50c4c0745d7dda9737199f79d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\UQ4uSu8U9J.bat

Filesize
182B

MD5
26d417250b1929041937f6e24b261111

SHA1
e68ba6e3bb207389991c9a39deda1ec73d00f4fd

SHA256
d3a2e7defafba0f8a407a22810519119f07729d34f2dc1ca678c74ac796a393b

SHA512
900a1af5cd6b5aafc5cb4305ab2c997f8a195a4e81e9887228338ac3a30011752c8e6f616f4791ce5a1143e1d98f3d7fda57536cd5c8ad3dd08fcee58707eb16

Download Submit
C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat

Filesize
182B

MD5
ec1c277c60d87e43254f6cfe638eeb2c

SHA1
78a39b5d03588407fddd78396c6de68d46eca9ae

SHA256
0bbd400b116da2e2edc643021e36cb9cd67e46d691611658cdba4524dddaf83b

SHA512
f631a4b9d0daf680c3c9692f26816a23493a4ed59e5f5445bd4f23e1058af29ca0f3ebf9ceefd36691e0de973495bb379591e49b41a653403a7c303a304385db

Download Submit
C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat

Filesize
182B

MD5
d0677d7591cf08caab99378b9f3adcb0

SHA1
89676ff619936f2bbcb9099f353bb3394c3c4d23

SHA256
fa590a7aa2ea2f60399b64e72e35fbb1c59c75df99420eb40bc08efd10106252

SHA512
8094e35193207885657d9c704f1fff8103fe03b012cfc4f55735e78ce68f434c1c485c02b05450d131a60a2b47ae6982e63c59767997e150109617ba8c3e135d

Download Submit
C:\Users\Admin\AppData\Local\Temp\X5jGqiFaSS.bat

Filesize
182B

MD5
e43ebc430caa6f76e82b3fa5be01fe8d

SHA1
2aebfcf6bc1ad5dd8f9b0710cadb2c96a1d5a800

SHA256
64b8f7936a3dc41377a65d6aac2cbe57975bad9425996b0f10188679aa537654

SHA512
ba89446d6e622aa66431f1ef35843591e55ec8009dfa788eb26ef2d53fd9a70a04d1ff8e0fd207e4c80dda252162005f37aed7f597241fc68ebb4e3a629953a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat

Filesize
182B

MD5
8455362421e66b4269ad8ff8dcdbb8bc

SHA1
5835af12fd744b6124756744ad693832012f26bf

SHA256
866452d76a138b98bb80ed13d06b6c8ce43210a00c41c4eb5485374553449bff

SHA512
31b632e29284d3819066e2e37060f71d263898e6ce70e2d55ba9e91b9660197dd00b52860b41860961e96a1166d9dde0171595c78f90e3d43d1ebb655938574b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ja0jqiuk.ngd.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msQYHxuKnC.bat

Filesize
182B

MD5
d26855d313456bb66f5508e3c6c3e808

SHA1
c3049a733367970bae96e37148401cc821148a31

SHA256
6e9385b7fbe89778de4e63fa0db4ddd4b88accec8134618f5e1d957055506485

SHA512
f21d479bf0845fdc4afe4d14a9708b89cb291905ee218ae0242fa3c3893af548f72f16cfd569cd4734d9d533b6211f37a73705bb4b5027018d1e73ae27d7c14d

Download Submit
C:\Users\Admin\AppData\Local\Temp\qqpXlQnQd1.bat

Filesize
182B

MD5
189badcc70bbe5c6929b97ec0330b21e

SHA1
ea797bfa5a45282b4a93d1509d876c550ffec6b0

SHA256
e58e47d0e384c325036fb64aa69a1244613b4f3e7d206907682d358fc1de7279

SHA512
ada4bd44d09f87ba6e74b1513c12adee69147dd04b327c7d21c94f8161b989fd608e4535848efac05143eac1f87562e4ef1462a92e241f88dd4e4e59ec506dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\qzqLwOyuSO.bat

Filesize
182B

MD5
e93e359e22fa611dd5e84990ccbc2a59

SHA1
66ba6de88fb981d51a391b8d0a185febdeac984b

SHA256
d030aa8b1d38caf387cc51ef0d2e716b259ee605f169486072f051c052e261fd

SHA512
fb2528d71839526485b965e534e5d8232a60fc74b3cc3aeb9035a8e270997655260c92b2310ebfb8a88223964fe13c3b401227bd73b2c924bd5021c55c4476c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\t6OOvELCCF.bat

Filesize
182B

MD5
0b8dd6080296a64052b98068890a99aa

SHA1
f0cc2c1031b658ed60ce477e2c23e18e90836363

SHA256
45c0bab73af695055c01c3acb895b9e1053ad8afefb5debcc45acf8a990237e5

SHA512
6e55124b5d2efbd6a5e52c87cf64a5bc655045ba9112442bc97a79085befe654663f7c0d93a18f6aaea6a856ac9746db5f26956c2ed4239d3ae6a7aeada1ed4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
182B

MD5
b202977ae25de014ef817360b454750a

SHA1
a87534c2e98c85a48d170eea1bff974a60c49fc1

SHA256
01d0b384049fb519a52fd5b36d3b0b97ad26550bf9d4f5df3fa52682a1ca2d03

SHA512
fe47c5bed303cc297436b35624d5c94f50d71b73ddd4bb5e6aa9dbe1ad1482ee29af86d97fcc5ebb4f3118e2bd049d2a4da4bae33863ec2728b1a338ce065d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\xm2kK1SIVO.bat

Filesize
182B

MD5
c27a182371afdb64a2ad1785c5612b53

SHA1
f2fb8fcb9f3dd8c22dc3f6ce615886dfae91e3d8

SHA256
9f87ccf5f7596323316c2270015a2b720e6c6d74c885a854afb3303c6e27e3b9

SHA512
b728b884f5b5352ae93d81cde56492b4f0e44a75a3d79ff5d3fe4874ca224923b8d731b9c62c1298770e6d140d9ca42589fdb6a69b6de63f30e3d98d0349ae36

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
C:\odt\sihost.exe

Filesize
1.0MB

MD5
53fe63742a4ace1a43288113da3f1f72

SHA1
3ad210a0dd948955134883ccd69a0cf2a6e71365

SHA256
5fc11059b96d7de3cda9670d792802b8ce7550c1622327488b2ed47e108aac2b

SHA512
4cb339acde55dd93e04f318cf74be7412f2578d0b4b530585adff5adf7db85e67bb7a71aff9bacfccd5dbbaf9ae03d836281ee803d2500438e5fc9bd56863fbf

Download Submit
memory/484-295-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/484-349-0x0000021527450000-0x0000021527460000-memory.dmp

Filesize
64KB

Download
memory/484-346-0x0000021527450000-0x0000021527460000-memory.dmp

Filesize
64KB

Download
memory/580-334-0x00000249E56D0000-0x00000249E56E0000-memory.dmp

Filesize
64KB

Download
memory/580-291-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/580-335-0x00000249E56D0000-0x00000249E56E0000-memory.dmp

Filesize
64KB

Download
memory/1972-320-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-354-0x000001D9375F0000-0x000001D937600000-memory.dmp

Filesize
64KB

Download
memory/1972-352-0x000001D9375F0000-0x000001D937600000-memory.dmp

Filesize
64KB

Download
memory/2448-289-0x0000014A72EA0000-0x0000014A72EB0000-memory.dmp

Filesize
64KB

Download
memory/2448-288-0x0000014A72EA0000-0x0000014A72EB0000-memory.dmp

Filesize
64KB

Download
memory/2448-209-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/2472-341-0x000002D6C9CB0000-0x000002D6C9CC0000-memory.dmp

Filesize
64KB

Download
memory/2472-292-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/2472-338-0x000002D6C9CB0000-0x000002D6C9CC0000-memory.dmp

Filesize
64KB

Download
memory/2564-297-0x00000255EF6A0000-0x00000255EF6B0000-memory.dmp

Filesize
64KB

Download
memory/2564-298-0x00000255EF6A0000-0x00000255EF6B0000-memory.dmp

Filesize
64KB

Download
memory/2564-234-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/2568-331-0x000002303C620000-0x000002303C630000-memory.dmp

Filesize
64KB

Download
memory/2568-332-0x000002303C620000-0x000002303C630000-memory.dmp

Filesize
64KB

Download
memory/2568-366-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/2820-313-0x000001B8E5F00000-0x000001B8E5F10000-memory.dmp

Filesize
64KB

Download
memory/2820-268-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/2820-317-0x000001B8E5F00000-0x000001B8E5F10000-memory.dmp

Filesize
64KB

Download
memory/3108-309-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3108-350-0x00000150EDA10000-0x00000150EDA20000-memory.dmp

Filesize
64KB

Download
memory/3188-270-0x000001FC6B080000-0x000001FC6B090000-memory.dmp

Filesize
64KB

Download
memory/3188-261-0x000001FC6B080000-0x000001FC6B090000-memory.dmp

Filesize
64KB

Download
memory/3188-193-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3220-136-0x000000001BB80000-0x000000001BB92000-memory.dmp

Filesize
72KB

Download
memory/3220-133-0x0000000001860000-0x000000000186C000-memory.dmp

Filesize
48KB

Download
memory/3220-131-0x0000000000F90000-0x00000000010A0000-memory.dmp

Filesize
1.1MB

Download
memory/3220-132-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3220-137-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Filesize
48KB

Download
memory/3220-134-0x000000001BBA0000-0x000000001BBB0000-memory.dmp

Filesize
64KB

Download
memory/3220-232-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3220-135-0x0000000001870000-0x000000000187C000-memory.dmp

Filesize
48KB

Download
memory/3360-246-0x00000233CF4A0000-0x00000233CF4B0000-memory.dmp

Filesize
64KB

Download
memory/3360-271-0x00000233CF410000-0x00000233CF432000-memory.dmp

Filesize
136KB

Download
memory/3360-253-0x00000233CF4A0000-0x00000233CF4B0000-memory.dmp

Filesize
64KB

Download
memory/3360-278-0x00000233CF730000-0x00000233CF7A6000-memory.dmp

Filesize
472KB

Download
memory/3360-186-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3668-311-0x000001D87EF50000-0x000001D87EF60000-memory.dmp

Filesize
64KB

Download
memory/3668-365-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3668-315-0x000001D87EF50000-0x000001D87EF60000-memory.dmp

Filesize
64KB

Download
memory/3860-359-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/3860-275-0x000001F6487A0000-0x000001F6487B0000-memory.dmp

Filesize
64KB

Download
memory/3860-272-0x000001F6487A0000-0x000001F6487B0000-memory.dmp

Filesize
64KB

Download
memory/4044-279-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4380-293-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4380-343-0x000001E373E30000-0x000001E373E40000-memory.dmp

Filesize
64KB

Download
memory/4440-296-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4440-347-0x0000017C3A680000-0x0000017C3A690000-memory.dmp

Filesize
64KB

Download
memory/4484-356-0x0000020FEEB40000-0x0000020FEEB50000-memory.dmp

Filesize
64KB

Download
memory/4484-358-0x0000020FEEB40000-0x0000020FEEB50000-memory.dmp

Filesize
64KB

Download
memory/4484-363-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4504-290-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4504-336-0x0000018447CA0000-0x0000018447CB0000-memory.dmp

Filesize
64KB

Download
memory/4504-339-0x0000018447CA0000-0x0000018447CB0000-memory.dmp

Filesize
64KB

Download
memory/4624-277-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4624-329-0x00000261606B0000-0x00000261606C0000-memory.dmp

Filesize
64KB

Download
memory/4816-294-0x00007FFAD9790000-0x00007FFADA17C000-memory.dmp

Filesize
9.9MB

Download
memory/4816-345-0x000001BA70010000-0x000001BA70020000-memory.dmp

Filesize
64KB

Download
memory/4816-348-0x000001BA70010000-0x000001BA70020000-memory.dmp

Filesize
64KB

Download