Analysis

  • max time kernel
    6s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2024 08:16

General

  • Target

    68DFE1E08B8CC7D19FF72334FDD09DB8.exe

  • Size

    4.1MB

  • MD5

    68dfe1e08b8cc7d19ff72334fdd09db8

  • SHA1

    34fb36f9b553c26b0753f540b6a8af1760bb74dc

  • SHA256

    a5f4363625928d7fb64087212bd9d094972260739b274f44b53bbbd5be6d19b7

  • SHA512

    035d3806dafbd5e3a6358072363267178215c74a2f66750792e839d8f24a4244338d1a59862953eb872b5a13ae675647310818a05f1f70206f1ea15157cc8686

  • SSDEEP

    98304:b2iJbE5xmRwLHVZCC55YkdOsfMvBh0ND4wELWZ:yMaxAWHVkq5Y2fMkNDILWZ

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 17 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68DFE1E08B8CC7D19FF72334FDD09DB8.exe
    "C:\Users\Admin\AppData\Local\Temp\68DFE1E08B8CC7D19FF72334FDD09DB8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\ÑyberLoad.exe
      "C:\Users\Admin\AppData\Local\Temp\ÑyberLoad.exe"
      2⤵
      • Executes dropped EXE
      PID:4936
      • C:\Users\Admin\AppData\Local\Temp\MVPLoader.exe
        "C:\Users\Admin\AppData\Local\Temp\MVPLoader.exe"
        3⤵
          PID:3460
        • C:\Users\Admin\AppData\Local\Temp\CyberLoader.exe
          "C:\Users\Admin\AppData\Local\Temp\CyberLoader.exe"
          3⤵
            PID:1048
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\msPortRefnetdhcp\zRMFcMzN1094wnGdurNck4fGlt.vbe"
              4⤵
                PID:2628
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\msPortRefnetdhcp\m6JlOKDKnmGOe6a.bat" "
                  5⤵
                    PID:2304
                    • C:\msPortRefnetdhcp\componentWininto.exe
                      "C:\msPortRefnetdhcp\componentWininto.exe"
                      6⤵
                        PID:904
                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                          "C:\Recovery\WindowsRE\TrustedInstaller.exe"
                          7⤵
                            PID:4480
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9ee0076-7ea7-4874-b88b-e9177fbb1464.vbs"
                              8⤵
                                PID:2160
                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                  9⤵
                                    PID:4060
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbfb69bc-c075-4c3b-a4b5-0c417549f563.vbs"
                                      10⤵
                                        PID:3800
                                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                          C:\Recovery\WindowsRE\TrustedInstaller.exe
                                          11⤵
                                            PID:4392
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5adc8a36-11f1-4cf8-8373-2f9bed59ff9c.vbs"
                                              12⤵
                                                PID:572
                                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                  13⤵
                                                    PID:3712
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8058d4c0-1639-4d67-93cb-918b0bf3a5ca.vbs"
                                                      14⤵
                                                        PID:1384
                                                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                          C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                          15⤵
                                                            PID:4028
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00900bbe-a1a2-4bfb-a064-5542fb9a2403.vbs"
                                                              16⤵
                                                                PID:1468
                                                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                  17⤵
                                                                    PID:532
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\143cc8fe-2e5d-4b5b-a568-4b693b14c9d9.vbs"
                                                                      18⤵
                                                                        PID:3468
                                                                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                          C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                          19⤵
                                                                            PID:2896
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87c52eea-b259-4f0c-b2f1-1cf26be1fbcf.vbs"
                                                                              20⤵
                                                                                PID:2208
                                                                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                  21⤵
                                                                                    PID:3444
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52532dd7-a923-42a4-b72d-e53450dda146.vbs"
                                                                                      22⤵
                                                                                        PID:4664
                                                                                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                          C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                          23⤵
                                                                                            PID:3464
                                                                                            • C:\Windows\System32\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb7fb210-c78b-4572-ad55-9423dc66b3ab.vbs"
                                                                                              24⤵
                                                                                                PID:2496
                                                                                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                  25⤵
                                                                                                    PID:1688
                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c02573e6-09ae-4a84-b889-1efe7587ad0a.vbs"
                                                                                                      26⤵
                                                                                                        PID:4300
                                                                                                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                          C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                          27⤵
                                                                                                            PID:3792
                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8169a4b5-b70f-471e-8d83-da2ad75f9172.vbs"
                                                                                                              28⤵
                                                                                                                PID:4392
                                                                                                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                                  29⤵
                                                                                                                    PID:1364
                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca1cb197-ab6b-4c78-a663-267a5c6535be.vbs"
                                                                                                                      30⤵
                                                                                                                        PID:2776
                                                                                                                        • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                                          C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                                          31⤵
                                                                                                                            PID:1260
                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\733e315f-f6dd-4ec8-8329-4eeb72c896ae.vbs"
                                                                                                                              32⤵
                                                                                                                                PID:1028
                                                                                                                                • C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                                                  C:\Recovery\WindowsRE\TrustedInstaller.exe
                                                                                                                                  33⤵
                                                                                                                                    PID:3252
                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78ac76ec-cf59-434b-a4e5-2ed537d94220.vbs"
                                                                                                                                      34⤵
                                                                                                                                        PID:3264
                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be66aa15-2b11-43b2-9b43-f2a74e009fba.vbs"
                                                                                                                                        34⤵
                                                                                                                                          PID:2148
                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af617c1f-b988-430e-8f74-a0a28316bfdc.vbs"
                                                                                                                                      32⤵
                                                                                                                                        PID:1452
                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a45686cc-37b1-428e-ab73-3a7d47df02aa.vbs"
                                                                                                                                    30⤵
                                                                                                                                      PID:2172
                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cdf60ff5-d79e-46ee-bab2-a150e674bce8.vbs"
                                                                                                                                  28⤵
                                                                                                                                    PID:1764
                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33bff42c-1d2d-4843-9595-d1611cbe04fa.vbs"
                                                                                                                                26⤵
                                                                                                                                  PID:3648
                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03d1b6bd-53e1-4389-80c8-31f4e71206d6.vbs"
                                                                                                                              24⤵
                                                                                                                                PID:2668
                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6cb37077-7b5d-46b6-891d-1db55d15e4bb.vbs"
                                                                                                                            22⤵
                                                                                                                              PID:2324
                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c091cf82-18bc-4311-9519-33a01c37c951.vbs"
                                                                                                                          20⤵
                                                                                                                            PID:2612
                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4230705b-649b-431d-b16d-c0e703b8d7e8.vbs"
                                                                                                                        18⤵
                                                                                                                          PID:1552
                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fb7153e-6b16-439a-9847-64a506751def.vbs"
                                                                                                                      16⤵
                                                                                                                        PID:3396
                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3d03bf1-b14b-4cb5-9704-4de97a333463.vbs"
                                                                                                                    14⤵
                                                                                                                      PID:4588
                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc42a7d4-fcb1-4c50-a774-f41ec04f9751.vbs"
                                                                                                                  12⤵
                                                                                                                    PID:5028
                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53d44db7-8fbc-4ccb-b3c0-c3b7daf893e9.vbs"
                                                                                                                10⤵
                                                                                                                  PID:3184
                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0b392bd-eba4-45ac-84b6-3bb46f36d701.vbs"
                                                                                                              8⤵
                                                                                                                PID:4564
                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                        "C:\Windows\System32\WScript.exe" "C:\msPortRefnetdhcp\file.vbs"
                                                                                                        4⤵
                                                                                                          PID:876
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:544
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4996
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1184
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\odt\sihost.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4448
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:636
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4564
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default\OfficeClickToRun.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:800
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:2184
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Default\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4716
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:3308
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1308
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4888
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\msedge.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4400
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\msedge.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:2148
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\msedge.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:3388
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1380
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:2336
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:3468
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\appcompat\appraiser\Telemetry\WmiPrvSE.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4588
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\appcompat\appraiser\Telemetry\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1216
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\appcompat\appraiser\Telemetry\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:1284
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\odt\services.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:5020
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:2896
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:912
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:5064
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:4292
                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
                                                                                                    1⤵
                                                                                                    • Process spawned unexpected child process
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:3924
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
                                                                                                    1⤵
                                                                                                      PID:3264

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Recovery\WindowsRE\TrustedInstaller.exe

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      MD5

                                                                                                      03f531ba947b5a31eb66f037ab21b36c

                                                                                                      SHA1

                                                                                                      918b36a92d76e2976bbbd0bc4435e0618482f7fd

                                                                                                      SHA256

                                                                                                      171b4720781b71f2bace24fd86001ca9634ea6f9501863518d1b80730fecdb44

                                                                                                      SHA512

                                                                                                      895a76eb7f4c0834449674227675d0aaa8a43f4258af26d0544a2ccbe9fcdb155621559e4fb7b20714860d0a2e9be447e7efadaff3bdec4edff3da0cee69f90b

                                                                                                    • C:\Recovery\WindowsRE\TrustedInstaller.exe

                                                                                                      Filesize

                                                                                                      2.6MB

                                                                                                      MD5

                                                                                                      1743e6d45b282cc31e8262f39442f1c7

                                                                                                      SHA1

                                                                                                      e94718cce628cf02e18ffbcfe15fc3c2c64a964f

                                                                                                      SHA256

                                                                                                      3c62a4a88e2e2c2ccea782bab5daab123e64bba01a4635c2762375f3b0ccd228

                                                                                                      SHA512

                                                                                                      f8b18bbcabac7b266e64dd5d9d18556711e7b512fa73edd87a72506effcf0852a9af2572b950ca515e504bed367a2c601649017de08ed1a612c64a5afdbfc6aa

                                                                                                    • C:\Recovery\WindowsRE\TrustedInstaller.exe

                                                                                                      Filesize

                                                                                                      2.1MB

                                                                                                      MD5

                                                                                                      33b38da0bc60991b971e6aa46633d9b1

                                                                                                      SHA1

                                                                                                      22076ae375764fab15809c5e10fc44bacf084cc2

                                                                                                      SHA256

                                                                                                      783dc3338713e7cac82379b7688193e1240078051218b35aa65612c2e0bf8188

                                                                                                      SHA512

                                                                                                      50d616dd0cb291f21795aa1483c3281a5ea06203ff8e5120e1105aad934ddabdf760510dcae2f04486275364a6665f16a03f55f9bab07b8968bce07d1161fd0b

                                                                                                    • C:\Recovery\WindowsRE\TrustedInstaller.exe

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      MD5

                                                                                                      c81d5b427b8575f1410ec0f1eb2d6b6e

                                                                                                      SHA1

                                                                                                      5d5606d0f8dfbebf8d5d8c973f8d2024e5be817f

                                                                                                      SHA256

                                                                                                      fac2d79700f5a8f6f402e96c37d15948ab8f141e23ebfaf0b531dc4ff7664c81

                                                                                                      SHA512

                                                                                                      24ef2116170a3e6372cbad73a81639fcf9b5d299ba5ee375e63150ddc1ff51292309ae8b566f125b40eb1ce615ad47deed502ef16d529d96535d5d84e15afa35

                                                                                                    • C:\Recovery\WindowsRE\TrustedInstaller.exe

                                                                                                      Filesize

                                                                                                      717KB

                                                                                                      MD5

                                                                                                      db46c3b57ab03ec305c5215a43f055fb

                                                                                                      SHA1

                                                                                                      78ff2d5e1b3e9db7048fa8077338b04eedc9e7ae

                                                                                                      SHA256

                                                                                                      904b1afbd95f5e1a7b9701c7adb0b88f63d307af533400c96376570f34073f6e

                                                                                                      SHA512

                                                                                                      6337c6788117a592eebca30c9faa4c9755c15c0433f48c3f9724183b4df09c0e8d8d42d450945b6d3f66df8a4b6f5074218c109407552db5c5a7417515d8b5eb

                                                                                                    • C:\Recovery\WindowsRE\TrustedInstaller.exe

                                                                                                      Filesize

                                                                                                      639KB

                                                                                                      MD5

                                                                                                      606881050f110878fafa4b53161e60a0

                                                                                                      SHA1

                                                                                                      4773ef78f439edf69742cc1e817df8ff3ed2831c

                                                                                                      SHA256

                                                                                                      02ade1a7b998b910f59f5aa90230da1e7de2cb107162a8874876f485838e95de

                                                                                                      SHA512

                                                                                                      742bf248bf310b8a6f540ceacedfb7aaaf31771d7d5c406a0d07a2753b38fb326018eb6f51d9d65b80dfadfa76a25e3c4a3a308839b4b6ed95ee571e6f5f376e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TrustedInstaller.exe.log

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      49b64127208271d8f797256057d0b006

                                                                                                      SHA1

                                                                                                      b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                                                                                      SHA256

                                                                                                      2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                                                                                      SHA512

                                                                                                      f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\00900bbe-a1a2-4bfb-a064-5542fb9a2403.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      d988b8dd983b9d9222b40b489348c557

                                                                                                      SHA1

                                                                                                      9b11466a4ef854aed28264a80946d008e84b357e

                                                                                                      SHA256

                                                                                                      7cfe07b969c4b7769c232db328c17f73ee424d1bf0e2ea098240a624531aed69

                                                                                                      SHA512

                                                                                                      797e0e83b335a7379be696608161301c4c707ffe336ed5c85754207e7bb1d15571ddb1f72b1e27832739b1e6da848a120169206b7b614bd2dcf61f300ac862de

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\143cc8fe-2e5d-4b5b-a568-4b693b14c9d9.vbs

                                                                                                      Filesize

                                                                                                      717B

                                                                                                      MD5

                                                                                                      40d61e14f1ba2ff357cdcb92682fa6fb

                                                                                                      SHA1

                                                                                                      698d8e5060c79cecc5343949808e6535749f7f84

                                                                                                      SHA256

                                                                                                      e28f8d480883b1901d8231eaa73122e467034648db6ca6de4ee9960677b4a3f2

                                                                                                      SHA512

                                                                                                      a03462fed6d2794badd6b36178d50662f86c7ad26b293ed173597d03812a97df4afcd2f04c804f756ee957cc75e14cb72872814f460922a7fea6fcebcebdbf28

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\52532dd7-a923-42a4-b72d-e53450dda146.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      025fee54938b897c0cfa51bfad3f8667

                                                                                                      SHA1

                                                                                                      9eebd51c468d33ce1f1d4c560a525ec64cc2be47

                                                                                                      SHA256

                                                                                                      970af32db83ce92a9b0ed2399e3eaf2f6496ff73394b62cd680076816fd2fc64

                                                                                                      SHA512

                                                                                                      6b3939ba38c3ff32acffc3dc7eea684c6d81960ba4efdb3a965de1f668f72580d0e21fcee3ac7a7495779d768c5fb19d6930ad83eb6dfd4134f39936007367fb

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5adc8a36-11f1-4cf8-8373-2f9bed59ff9c.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      0f879f18aed8734be78c36a8047942bd

                                                                                                      SHA1

                                                                                                      4c5d34ced633f4fd6285ebe184b9dd9711fa97a5

                                                                                                      SHA256

                                                                                                      08b50d0e1205a92a65deefb63c917ef8f66663633782f727884d813a420c64e5

                                                                                                      SHA512

                                                                                                      6e8b2dc73a2ef41606d737b24a8fc7806d684e8af30e6883e103b8bad9b93089c000a16682f40d102ee8177ce82270195e3ff5db96055d8840310f9963851280

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\733e315f-f6dd-4ec8-8329-4eeb72c896ae.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      617f7424559b7b6ee45d3804b7b6f12f

                                                                                                      SHA1

                                                                                                      760b1dc2dab38e7b2027470484a66ad90904bf31

                                                                                                      SHA256

                                                                                                      8e742f42cf9110cba333410b88053d1921592bc584e4d0780eecdbdc5e693b6a

                                                                                                      SHA512

                                                                                                      f475a18cb31a42192774855577ee2494e32ce683515a65234e3a0bb0b6fe31fbfa5347e8772d49c2f41af1e60ecf1a6e34c4a312891f5fb3fe2701c568d2804b

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8058d4c0-1639-4d67-93cb-918b0bf3a5ca.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      733d2e553c73dbdf1fb323920e42de09

                                                                                                      SHA1

                                                                                                      8883bb9cfe9d67acd730f8a0ce042c896375bd13

                                                                                                      SHA256

                                                                                                      4573fc874408d05264cf8ed5b95f69f36218fe76735b05308ab9ef1e527e49b5

                                                                                                      SHA512

                                                                                                      aaab679df8117eeabf63122df22749cf6c1366f93b82297d7c3a45288b356a43619982f5f87228ce067cf0423625e29784858e4da630cee07806eed193f8ca6a

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8169a4b5-b70f-471e-8d83-da2ad75f9172.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      6f14742aff4d9c38e881f750d24338fe

                                                                                                      SHA1

                                                                                                      0ba031c11cf7726d397a8ffd827f03b04a51ee36

                                                                                                      SHA256

                                                                                                      09421781f94227ab1ecc9dfb94ce0b7158c5a36a78124cca8b58938bfdad5d50

                                                                                                      SHA512

                                                                                                      c7e78796d16ee4279ce0bb80f43c170a628efae299e2771425b8468cbfe4264f13c1c1ee9acecd5f292b972e87e2cc275630fb60622ddd564ec8d39362015dbf

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe

                                                                                                      Filesize

                                                                                                      3.4MB

                                                                                                      MD5

                                                                                                      2409ef09b4ba0fd16cdeaca5faa04f7e

                                                                                                      SHA1

                                                                                                      49a6a8c80428ba64ff4e67eedfa7f6af4af7991e

                                                                                                      SHA256

                                                                                                      fd61de173f4047da0c786c3cc5c1b53cb20b60aad08b15737892de17fd92e15f

                                                                                                      SHA512

                                                                                                      4320f905a04e0ca6f4ac81485e922eb72b3b10316c01fb7817f07319026eaf9d2a23e50fdc76532beea66c04b79a2b8a255c35fce1fd4afb481c42942b8935e0

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe

                                                                                                      Filesize

                                                                                                      2.9MB

                                                                                                      MD5

                                                                                                      ccbe7cb11c55066736c69145a5624d11

                                                                                                      SHA1

                                                                                                      94f879751c552d4f238a448eafc7b5c97638c120

                                                                                                      SHA256

                                                                                                      10f2494413bb5515eda3552c2ca57616ca3f3990bdb2f770507e342083ebb05e

                                                                                                      SHA512

                                                                                                      b5c6e02de877bff1d4e7fc9455c6ac038209f99eb0d1c54fa715ee8172f67e772ce4e47b6b35f3bdf7cc4856c89beaf6bacfff6061d2c5bfba9c24d27f57b715

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe

                                                                                                      Filesize

                                                                                                      2.6MB

                                                                                                      MD5

                                                                                                      2a4499f3a730783fea00bee850390b09

                                                                                                      SHA1

                                                                                                      e64f913e1b30c46cc8f61ab95f829d5037b3be9d

                                                                                                      SHA256

                                                                                                      4b5f3c6b2c9ba878ab6dab2fcf99406cc3ed02f82ed81afa94ab72265441bff4

                                                                                                      SHA512

                                                                                                      c03d14b36916937b82224bd7d19526cee2dcb49532f47baa732bb8db2f57751694ae2df1dff63875b5608c93a043084a0c11744df157fcb6288ff3bb750dc054

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      MD5

                                                                                                      a8d74fa4b14727ec19b1ddd2fa3a8e61

                                                                                                      SHA1

                                                                                                      7fc4bd53271ed555111c7fba515006f82a8d286a

                                                                                                      SHA256

                                                                                                      47aeea09b4ff36819159cd2325e8e70f1ff7b5dc80c398ef80035b1e6c834866

                                                                                                      SHA512

                                                                                                      e585e2606bafa1fbac0865cf8854b08fb6f9a62180c85496de1111cba16113005e2f89bc2dc7154f62be836d292e7ea6ef79cc686622022f9e0675d0eb5bd3c6

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                      MD5

                                                                                                      c49eff4ab89798cf3ac5d952f710a135

                                                                                                      SHA1

                                                                                                      e40ac7e7cd329efc2bbdca2fecae5368fba68126

                                                                                                      SHA256

                                                                                                      1c365b3676e965b706b5cf172c77d4be1ea71b00ca30d6579702f420be0caf3e

                                                                                                      SHA512

                                                                                                      edc53e2804b5b66226c6415281bc546172239cb5ff9a65fe182f05c5e834089e72fa559546925e4b7713ae16fdd97039804999d5c2936391ad3c8c7e7b31c0df

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe

                                                                                                      Filesize

                                                                                                      755KB

                                                                                                      MD5

                                                                                                      57efcb2a60c4761230be4068ea87d361

                                                                                                      SHA1

                                                                                                      d0b86ba7a409c0f3fd2a64dbaed0f1c37dcc49b0

                                                                                                      SHA256

                                                                                                      a8cca4829a05d9c55a0a8ea6774365702da8299e77ef071972abb55428c5a35d

                                                                                                      SHA512

                                                                                                      e92be040870dcda8c5e8cb69791944345d21326b21adbdfcc3d1ab324c4e59ae941d48b5942ba60a06b9a93a9e4cce394f33529fba57cf658447a9d409799ca1

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\87c52eea-b259-4f0c-b2f1-1cf26be1fbcf.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      aacf42054099a9baa9bb94e59f0b3841

                                                                                                      SHA1

                                                                                                      a7196cf568548f9789cb7d54aecab3e7f54c5c47

                                                                                                      SHA256

                                                                                                      c65983a3a00e0c6c9ffd293032b272c75d31218361a286aac3ab6e0dee3de4a7

                                                                                                      SHA512

                                                                                                      b2b4889bcc53a9b6a1a289f54f8560911be6c7e6e3b19abba7c7c949998c0eb3fee824da761b1b11fb607a55cf19374666c9c098470dfb3f57d1278afdebc38d

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\CyberLoader.exe

                                                                                                      Filesize

                                                                                                      3.7MB

                                                                                                      MD5

                                                                                                      1b4cf2a40e1387cf97dfbe1303c9619a

                                                                                                      SHA1

                                                                                                      a3f98a0ca89495958f6171f775aa6b96bdf6e0de

                                                                                                      SHA256

                                                                                                      6e7050be5d9e4042ba632c228890329f41550608b6de25094bdf5e4ae9448833

                                                                                                      SHA512

                                                                                                      a45b2066cc48cfab284fd61ab5413ba0368bb457af22425a8b469a83ca4ff75f3378b43dc6ce988caac98b8272333e31e590a3c2ae8a3ffd4b1fe9199f5b8400

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\MVPLoader.exe

                                                                                                      Filesize

                                                                                                      340KB

                                                                                                      MD5

                                                                                                      f1f43cf5a79e51ba13ef602b25c63a9e

                                                                                                      SHA1

                                                                                                      df986285c4e6f2355b0f528a13063f5d855a250c

                                                                                                      SHA256

                                                                                                      4dff4a3558b40b19e961fc8adc45e00b2b7dbd6ebabbc219d1446bc6ca5350e8

                                                                                                      SHA512

                                                                                                      6867d3d6d01a4a170e4d5ab9115408a97c7e5a00730632259d9afae7b688f214c455c014bdff2fc90185dd92f96c06d0c13f39ab09535e1add9fb7ea49ec5384

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c02573e6-09ae-4a84-b889-1efe7587ad0a.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      777b0fb19f2f483fbecf86f7378099e8

                                                                                                      SHA1

                                                                                                      7c4ac8ffb199f8bdf8df1a10499c2e52e932dbaa

                                                                                                      SHA256

                                                                                                      6c1ce3db617e91a79e8fae16ce4327907902f0be3873c32f3545374ab73d0405

                                                                                                      SHA512

                                                                                                      cdf6363aac984e25de62d77e07e27cca94c7d1c2d781288d12e7ff2dbf0a6aeaedec8d61b2545d13e610b53054ee81310ed22033e396a2cf8b7f586d6d32b332

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c9ee0076-7ea7-4874-b88b-e9177fbb1464.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      af9f930835c5a8eca48caa4c458d4e3e

                                                                                                      SHA1

                                                                                                      1add351a56bde3c23a6e6862a303fe70abe24b8c

                                                                                                      SHA256

                                                                                                      3b710018aa4b23fbe2a337e1ea2da049f8912644387c1c715b83a6fc9f41eb1e

                                                                                                      SHA512

                                                                                                      b6277f5a8ece102d6266b5290e79e254b14c8c52d57fffd40b897b6e96d4f2d2fed2b921275e0c999f70021222a3a1584b8289c3b393bc5f4aa1c0f0a576917f

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ca1cb197-ab6b-4c78-a663-267a5c6535be.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      531bb82eb3a4a909a736ad8f884f4b7b

                                                                                                      SHA1

                                                                                                      80422179289a15819be1b8774f445e60a35dda03

                                                                                                      SHA256

                                                                                                      ad5bb85a45330ad380323f33558c41280104408563087de0b88824ac05a30b01

                                                                                                      SHA512

                                                                                                      01be16af3d7364062dffccce973e0c3d6d0a96c74f07f7dc5e30b3832546fe7d5fc33dc017407f5156df93d4573839b0607d516a254cae20c48cc46500dba086

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f0b392bd-eba4-45ac-84b6-3bb46f36d701.vbs

                                                                                                      Filesize

                                                                                                      494B

                                                                                                      MD5

                                                                                                      caf32538dd0579c0f2e50468eada9f82

                                                                                                      SHA1

                                                                                                      c99d46d1981ba0a752b76b225f99dbc88a4e0153

                                                                                                      SHA256

                                                                                                      c6a6d03effad8b18178c579fa349387ed7ea6f820d82e11587b3a326aeb63a8c

                                                                                                      SHA512

                                                                                                      d27d2edf39f22962e9b4a42853b31e6a120a9d6c1d444ce9a6e4d0a57432f708a6ddcfad465cd496ebabef9f5e83482398d595a383bfe6b1b989392fc976cf5f

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fb7fb210-c78b-4572-ad55-9423dc66b3ab.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      6c9f0741c843e55fddbcc72ee653e7ca

                                                                                                      SHA1

                                                                                                      613815370af5f009ff437f851c140dda8035c820

                                                                                                      SHA256

                                                                                                      3cdbb436dea7b29aeeeb2b2dd477e0a05ee245296067518f4d0ed44fc37058bb

                                                                                                      SHA512

                                                                                                      0f406ee08fd45d35b418505db968ecf49fdce972c27cc30f384ef4c52dd4a4e4dc8e9a9d5f58188b3132d3e8710e775fcfad36ed21c424d6179bdd706b75a003

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fbfb69bc-c075-4c3b-a4b5-0c417549f563.vbs

                                                                                                      Filesize

                                                                                                      718B

                                                                                                      MD5

                                                                                                      56af6b73eeac874f60bb81ad01e96de1

                                                                                                      SHA1

                                                                                                      5e42dba3059956e3eca063b666b5eb0e081d452d

                                                                                                      SHA256

                                                                                                      c82663237a854e2c04fb88eb37cb088ce9bca3ac6d7533bef9e79cc9738c5d1f

                                                                                                      SHA512

                                                                                                      5b8b76c26ff5cfc6df6e0e292c4fb03485f517b22510e12425c5e9ad8babd63d8a293cb6e9eff428484235603d14d0cad03a60101f53193f4f15a15660652bb4

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ÑyberLoad.exe

                                                                                                      Filesize

                                                                                                      4.1MB

                                                                                                      MD5

                                                                                                      a84070968353edcc9559f54deedd8fe9

                                                                                                      SHA1

                                                                                                      27187ea020c4fcfad6783debbea35883b1125538

                                                                                                      SHA256

                                                                                                      6b1ff20c95ab7ea0d16f441c6726f6112bbae1c620696f2e9bec01b4926dc1f4

                                                                                                      SHA512

                                                                                                      134a25e91d0b088a9dd57ce0310a1f164f6586624dd71a02001ece26b70d3d8fd201ece35b5a9b15764f983cbf9da099b8f13b5e99584ada093f12c506a2500e

                                                                                                    • C:\msPortRefnetdhcp\componentWininto.exe

                                                                                                      Filesize

                                                                                                      3.4MB

                                                                                                      MD5

                                                                                                      53758cea18d59182a809208313d5042a

                                                                                                      SHA1

                                                                                                      0234e732dea00414c79ca2ce8a55f61843f282d2

                                                                                                      SHA256

                                                                                                      5cae0557099a16d45a03f05f95390ec5bd5ba5a44edd73286e741fe09f93bddf

                                                                                                      SHA512

                                                                                                      3d7900c7a6060367beaf7abde33027958d28091b001d25c395d191f0cf442216d5cacff4a123bbd1ae767f471ae3a517659f9c42798be8c772f2f7411a7b952e

                                                                                                    • C:\msPortRefnetdhcp\file.vbs

                                                                                                      Filesize

                                                                                                      34B

                                                                                                      MD5

                                                                                                      677cc4360477c72cb0ce00406a949c61

                                                                                                      SHA1

                                                                                                      b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                                                                                                      SHA256

                                                                                                      f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                                                                                                      SHA512

                                                                                                      7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                                                                                                    • C:\msPortRefnetdhcp\m6JlOKDKnmGOe6a.bat

                                                                                                      Filesize

                                                                                                      42B

                                                                                                      MD5

                                                                                                      b025044714b20d9d7069a2c2f55ddf04

                                                                                                      SHA1

                                                                                                      36d7dce3f0fa6a1bd86e795bcde3c9a1b2e9a7f6

                                                                                                      SHA256

                                                                                                      e6d9546e0e8d9b92ef203f408f33722c3b4ffcd2f400aa08bb0b49ac182b69b3

                                                                                                      SHA512

                                                                                                      3a24c4ad9c1b298a97c5d4e994233a84dc27d4c0d612cc8d8e94cbd16e3ceaec96d66d4503a6a506644de509a3509f53ea122bf92cc09de087254f40b5a1c65c

                                                                                                    • C:\msPortRefnetdhcp\zRMFcMzN1094wnGdurNck4fGlt.vbe

                                                                                                      Filesize

                                                                                                      208B

                                                                                                      MD5

                                                                                                      c7c964910bef0490e2a401349c25126b

                                                                                                      SHA1

                                                                                                      ba3581dc5945f35f83bc216fc5a1decfbe6e47ef

                                                                                                      SHA256

                                                                                                      d41a100832e46a8928ad06780a40e08f147e97ac014170ca48779f98f4d5b7ff

                                                                                                      SHA512

                                                                                                      198c571a056d5896928b5a93c918e9f7407dd0d5e39893db39a1dbcad9d6ec2df63925cbe69346f8f4681bfe37c23844feee5cbd1f45bc9c48796aef1d66372f

                                                                                                    • memory/532-190-0x000000001BC60000-0x000000001BC70000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/532-189-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/532-191-0x000000001BA90000-0x000000001BAA2000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/532-202-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/904-59-0x00000000032C0000-0x00000000032C8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-58-0x00000000032E0000-0x00000000032EC000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-84-0x000000001C7E0000-0x000000001C7EC000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-82-0x000000001C7C0000-0x000000001C7C8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-81-0x000000001C7B0000-0x000000001C7BC000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-80-0x000000001C7A0000-0x000000001C7A8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-78-0x000000001C780000-0x000000001C788000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-77-0x000000001C770000-0x000000001C77E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/904-76-0x000000001C760000-0x000000001C76A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/904-74-0x000000001C750000-0x000000001C758000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-68-0x000000001CA30000-0x000000001CF58000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.2MB

                                                                                                    • memory/904-79-0x000000001C790000-0x000000001C79E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/904-45-0x0000000000CC0000-0x000000000102A000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.4MB

                                                                                                    • memory/904-46-0x00007FFAE8500000-0x00007FFAE8FC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/904-116-0x00007FFAE8500000-0x00007FFAE8FC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/904-75-0x000000001C860000-0x000000001C86C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-69-0x000000001C500000-0x000000001C50C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-47-0x00000000018D0000-0x00000000018E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/904-72-0x000000001C530000-0x000000001C53C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-48-0x00000000019A0000-0x00000000019AE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/904-49-0x0000000003260000-0x000000000326E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/904-51-0x0000000003280000-0x000000000329C000-memory.dmp

                                                                                                      Filesize

                                                                                                      112KB

                                                                                                    • memory/904-73-0x000000001C540000-0x000000001C54C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-52-0x00000000032F0000-0x0000000003340000-memory.dmp

                                                                                                      Filesize

                                                                                                      320KB

                                                                                                    • memory/904-54-0x0000000001960000-0x0000000001970000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/904-53-0x0000000001950000-0x0000000001958000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-50-0x0000000003270000-0x0000000003278000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-71-0x000000001C520000-0x000000001C528000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-57-0x00000000032B0000-0x00000000032C2000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/904-56-0x00000000032A0000-0x00000000032A8000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-55-0x0000000001970000-0x0000000001986000-memory.dmp

                                                                                                      Filesize

                                                                                                      88KB

                                                                                                    • memory/904-83-0x000000001C7D0000-0x000000001C7DA000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/904-70-0x000000001C510000-0x000000001C51C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-60-0x00000000032D0000-0x00000000032E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/904-61-0x0000000003340000-0x000000000334A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/904-62-0x000000001C480000-0x000000001C4D6000-memory.dmp

                                                                                                      Filesize

                                                                                                      344KB

                                                                                                    • memory/904-64-0x000000001BD40000-0x000000001BD48000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-63-0x000000001BD30000-0x000000001BD3C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-65-0x000000001BD50000-0x000000001BD5C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                    • memory/904-66-0x000000001BD60000-0x000000001BD68000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/904-67-0x000000001C4D0000-0x000000001C4E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/2896-204-0x00007FFAE8500000-0x00007FFAE8FC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/3712-173-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/3712-162-0x0000000002C50000-0x0000000002C62000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/3712-160-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/3712-161-0x000000001B8B0000-0x000000001B8C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/4028-187-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4028-176-0x0000000003290000-0x00000000032A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/4028-175-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4060-131-0x0000000000D80000-0x0000000000D90000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/4060-143-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4060-132-0x000000001B270000-0x000000001B282000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/4060-130-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4392-147-0x000000001BD60000-0x000000001BD72000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/4392-146-0x0000000001220000-0x0000000001230000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/4392-145-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4392-158-0x00007FFAE8450000-0x00007FFAE8F11000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4480-127-0x00007FFAE8500000-0x00007FFAE8FC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4480-115-0x0000000001990000-0x00000000019A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/4480-114-0x00007FFAE8500000-0x00007FFAE8FC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                    • memory/4900-9-0x0000000000400000-0x0000000000828000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.2MB

                                                                                                    • memory/4936-26-0x0000000000400000-0x0000000000816000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.1MB