Overview

overview

10

Static

static

3

GameHackBuild1.exe

windows7-x64

10

GameHackBuild1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GameHackBuild1.exe

  • Size

    9.0MB

  • MD5

    35a0fbec2fc6d2a550a569719406d58d

  • SHA1

    bc73001a0600313803d3594dc51d3d0813dbdec1

  • SHA256

    221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d

  • SHA512

    2f4d71eaa62dded749f82660fd7ee90da422048459d63faa79f518c3c10b7343c482e95cf81cea6bfb4710ef07f53d2d7f835dd3f191029da38da2e9a7beb00f

  • SSDEEP

    196608:uGk5oFaEPX2GgYCCUDQ4yA8/vWOCFidWo+QOovFFoJXz0Bt99OGvFLuyAjA9UCo:9k5/EP2Gac4yHndWo+bodFgXz29OGNps

Score
10/10
dcratorcusgamehackdiscoveryexecutioninfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

GameHack

C2

31.44.184.52:25350

Mutex

sudo_06kkh814g4vz7sfklrh1emcow75dz383

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\Windows\Defender\MpDefenderCoreProtion.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 26 IoCs
    persistence
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Orcurs Rat Executable 11 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\GameHackBuild1.exe
    "C:\Users\Admin\AppData\Local\Temp\GameHackBuild1.exe"
    1⤵
    • DcRat
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2188
        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
          "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o0la155j\o0la155j.cmdline"
            5⤵
            • Drops file in Program Files directory
            PID:2648
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E96.tmp" "c:\Program Files (x86)\Google\Update\CSCB294A08ECF1B454AA0A4EC7C5767AD9E.TMP"
              6⤵
                PID:2084
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k4v3vsrs\k4v3vsrs.cmdline"
              5⤵
              • Drops file in Program Files directory
              PID:1476
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EF4.tmp" "c:\Program Files\Windows Journal\es-ES\CSCBCD9AEA27EAF42E9ACCB5BE916A50EC.TMP"
                6⤵
                  PID:2284
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ygc2l3uy\ygc2l3uy.cmdline"
                5⤵
                  PID:1448
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F51.tmp" "c:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\CSCDF4598FDA56A408FB8987B503084CAA6.TMP"
                    6⤵
                      PID:1864
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bdbvphge\bdbvphge.cmdline"
                    5⤵
                    • Drops file in Program Files directory
                    PID:1968
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FCE.tmp" "c:\Program Files\Windows Journal\es-ES\CSCECFBE14FCDC4435A8B936AF24849C8A7.TMP"
                      6⤵
                        PID:2708
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w2lijukn\w2lijukn.cmdline"
                      5⤵
                      • Drops file in System32 directory
                      PID:1620
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES401C.tmp" "c:\Windows\System32\CSCBED0F9ED82C54A17AD3DCC7519D1C35D.TMP"
                        6⤵
                          PID:1856
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\conhost.exe'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1284
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2016
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\spoolsv.exe'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2432
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Festival\cmd.exe'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2356
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\audiodg.exe'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1136
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1020
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1FYVKmsW5L.bat"
                        5⤵
                          PID:992
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            6⤵
                              PID:2140
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              6⤵
                                PID:2612
                              • C:\Program Files\Java\jdk1.7.0_80\spoolsv.exe
                                "C:\Program Files\Java\jdk1.7.0_80\spoolsv.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2080
                      • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
                        "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2712
                        • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                          "C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2204
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2776
                      • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
                        "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2940
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2800
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c ""C:\Users\Admin\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "
                            4⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3056
                            • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
                              "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
                              5⤵
                              • DcRat
                              • Modifies WinLogon for persistence
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Drops file in Program Files directory
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2136
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2224
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\lsm.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1452
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2784
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2012
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\es-ES\Idle.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:780
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\ja-JP\taskhost.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2216
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\conhost.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2580
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\services.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1140
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2120
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\dllhost.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1256
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\sppsvc.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1836
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskeng.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2344
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\explorer.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2448
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\conhost.exe'
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2472
                              • C:\Program Files\Windows Journal\es-ES\Idle.exe
                                "C:\Program Files\Windows Journal\es-ES\Idle.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:484
                                • C:\Program Files\Windows Journal\es-ES\Idle.exe.exe
                                  "C:\Program Files\Windows Journal\es-ES\Idle.exe.exe"
                                  7⤵
                                  • Modifies WinLogon for persistence
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Drops file in Program Files directory
                                  • Drops file in Windows directory
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2112
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\es-ES\Idle.exe.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1664
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\MSBuild.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1636
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\lsass.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2284
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\spoolsv.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1804
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2412
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\dwm.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2644
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2792
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\MSBuild.exe'
                                    8⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2764
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FyH7TMVdIN.bat"
                                    8⤵
                                      PID:1676
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        9⤵
                                          PID:2872
                                        • C:\Program Files (x86)\Windows NT\MSBuild.exe
                                          "C:\Program Files (x86)\Windows NT\MSBuild.exe"
                                          9⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1960
                                    • C:\Users\Default User\conhost.exe
                                      "C:\Users\Default User\conhost.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2928
                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
                            "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:2568
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {E63858D4-64A9-49A5-BA71-E2364322E8B5} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2796
                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2448
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:536
                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:1020
                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2696
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\lsm.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2332
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2328
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1152
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:988
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1968
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2116
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2736
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2840
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2828
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2684
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\conhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2716
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2100
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:324
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2940
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2740
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\ja-JP\taskhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1944
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\ja-JP\taskhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2700
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\ja-JP\taskhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1576
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Uninstall Information\conhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1428
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2664
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1216
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\services.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1120
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Fonts\services.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2812
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\services.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1804
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2036
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2856
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2004
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\dllhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2180
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\dllhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2500
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\dllhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1512
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\sppsvc.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2016
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows NT\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1544
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1136
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskengt" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskeng.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1676
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskeng" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskeng.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2312
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskengt" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskeng.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1868
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\system\explorer.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1536
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\system\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2116
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\system\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2572
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\conhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2840
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2712
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2204
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1472
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          PID:2900
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2576
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk1.7.0_80\spoolsv.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2832
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3008
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk1.7.0_80\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2240
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Festival\cmd.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2096
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Media\Festival\cmd.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1656
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuildM" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\MSBuild.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2744
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuild" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\MSBuild.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2540
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuildM" /sc MINUTE /mo 14 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\MSBuild.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1448
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\lsass.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2652
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\lsass.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2736
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\lsass.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2688
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\spoolsv.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1752
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Festival\cmd.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2588
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2960
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2560
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2336
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2444
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:904
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\dwm.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1624
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\es-ES\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:1136
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2104
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'" /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:1524
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2852
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:408
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuildM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\MSBuild.exe'" /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2612
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuild" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\MSBuild.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2624
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuildM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\MSBuild.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2096
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\audiodg.exe'" /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2200
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          PID:1356
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3064
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2896
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "runtimesvc" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2712
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:1944

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Winlogon Helper DLL

                        1
                        T1547.004

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Winlogon Helper DLL

                        1
                        T1547.004

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Modify Registry

                        2
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        2
                        T1552

                        Credentials In Files

                        2
                        T1552.001

                        Discovery

                        Query Registry

                        1
                        T1012

                        System Information Discovery

                        1
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        2
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files\Windows Journal\es-ES\Idle.exe
                          Filesize

                          4KB

                          MD5

                          8d5404934f97c6e2b8a071d45323404b

                          SHA1

                          6b3ab2a96c462fd97f106ae6c8b26dddfd17388c

                          SHA256

                          38c53cb21fab1eb59d0081d3dc56ff7543713d730a089ab708155de78680ee15

                          SHA512

                          a1a8fea68dfbba08460b828851984a5433ffe7e16558c345faf9d52037318b81391fa564ea678524cb751fc3ffee6bf437530359e39f60f8ef3d2d7b52e198aa

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\0bTYwk1H0x
                          Filesize

                          46KB

                          MD5

                          02d2c46697e3714e49f46b680b9a6b83

                          SHA1

                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                          SHA256

                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                          SHA512

                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab3E1B.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\DczAAqBpZa
                          Filesize

                          92KB

                          MD5

                          882ec2bb4bf46a0ee80134f7b7b5d2d7

                          SHA1

                          4f76f5db450eb1a57199f5e0bb4bb6a61b4a5d7a

                          SHA256

                          a101a238346d9df0fe89b33f45436042d92878d75c5528ad0b8e201b91db0402

                          SHA512

                          eed22fb4d714d6c438760378912286d41f4f1e1ad27d62240fd9fc3c304831567e552e2ffe2524a0869d57a0fd7c6494a1fbf1e0d8eb78f58a052be3a3c4caaf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\RES3E96.tmp
                          Filesize

                          1KB

                          MD5

                          cc27ae0ad2b3738cbd48762abc153210

                          SHA1

                          de66e30013e4179d56bde1a6b59faf637e0db7dd

                          SHA256

                          9ad7662757fb6fb75a55479cbb40ec532cc73ff639b3985272fe9f16a5684947

                          SHA512

                          26c064065b52fd0d69f3322d7ef9cba6c0decaddb32ede357189a05368474173f327572c45fe0465a00e7bfee2b5e23a36180ad4ee4e9af3f5e684b462636052

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\RES3EF4.tmp
                          Filesize

                          1KB

                          MD5

                          4870be4b8badaed4b07c4ff2b9b1e87c

                          SHA1

                          65c09a55f227d9ea29574de0d69f02ee46634daf

                          SHA256

                          45d227aa0f232bac2f6ac975a4aa4572c77025f88d55d768e7e11a13ff2cd7b2

                          SHA512

                          ac58a4fd93f9025335a6d6918c270a1a22f321165bd09fd156073842d8d3cc171df2deec6e02f802cb606fdeb4435307b243cb99d9bd6a3f1286845124e1c3ac

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\RES3F51.tmp
                          Filesize

                          1KB

                          MD5

                          cb35ac7626e8fc5575a0a5800c684e36

                          SHA1

                          3e4e413abc0ec625fcd5ab2aa920d5c92d27f590

                          SHA256

                          516183f604cae2d1564dcedcbc4cf8e8fe703416d55b20b39221de0c1d05c5ed

                          SHA512

                          1e06496f853cf08f163c1a350769473e338748de65591999e3991877ca1bfe6b372d1c2b316bbd4cad7936641ba549a3f32138cc5e323ff9ecc9151f63caafe7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\RES3FCE.tmp
                          Filesize

                          1KB

                          MD5

                          fe869d828d68f3f479b3e081b2dd277a

                          SHA1

                          dfce4f17435d54e5fecc8d189bcd17c23d52501b

                          SHA256

                          87c734762820980cce528f3be6d41ef26f29b617df6ba51e36d5376974ca9c45

                          SHA512

                          49971a84f909db641aa1aaf62a1eaec2faaad63057d7d90216e9704d37df0d500d483e447144e89e548542e20ee4119c3d5b983a9ddfd930cc95b4b2d6fe0cd9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\RES401C.tmp
                          Filesize

                          1KB

                          MD5

                          11c6addf90c508a66e712983564fb57f

                          SHA1

                          1aff296e9891bde148cc260d0a7f17a361e7e894

                          SHA256

                          f0e80a2c40ea813135a723ea7a9394a3924dbeda2478d3aebf5dc821f119288d

                          SHA512

                          96eee45e79fcda2a3288601309b77ff83ba1686aa26ef14b92ec32f13bb99f68a3715b1e6a2046018092c6eccb2c543d8fa5f01b418e721aa7994acb03628151

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\g5pmjgYw45
                          Filesize

                          20KB

                          MD5

                          c9ff7748d8fcef4cf84a5501e996a641

                          SHA1

                          02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                          SHA256

                          4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                          SHA512

                          d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                          Filesize

                          7KB

                          MD5

                          09c2e72ee60f0bd002c50c198214611a

                          SHA1

                          659d2a308ab8078c9ec3e888d0ba47027aa1fcbb

                          SHA256

                          30168b7264fa8da2fcf659828929bbc6da221f2cf85f6722ec23f916f118fe13

                          SHA512

                          1f7e44fe6dbff8244c0ab4e11b66f5606aa89dddae7b5520debd5849a5e16e595673a72052623c004af08a3be32c537d79079dc156f324f83cefd8f965958079

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat
                          Filesize

                          104B

                          MD5

                          fbef3b76368e503dca520965bb79565f

                          SHA1

                          9a1a27526b8b9bdaae81c5301cd23eb613ea62ba

                          SHA256

                          bcb2af67a4ea1e6aa341cf3141941dbe7b17f1911e7f20aba46552571f99c9f3

                          SHA512

                          2b99bc9a945b6d9a2c0d3206dce9221eb7f4a2040c5096909d60c3278254c52b39a28dd18dd4e005eff0ebd7e7cba6dd3a6a94ea8a7d7598da3001da174db3f5

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
                          Filesize

                          1.6MB

                          MD5

                          bc7804fca6dd09b4f16e86d80b8d28fa

                          SHA1

                          a04800b90db1f435dd1ac723c054b14d6dd16c8a

                          SHA256

                          1628864ab0bafe8afea2ad70956b653550dab3db7c4cdf6f405e93a6c2441dce

                          SHA512

                          7534ac0a215f02af85bdf2b414e23face0570943f8820e7bfe97ea274ccd1a01618556e93b7465c2d9fbb0bcde5e97fab9e9b6bddd366554277ef308cde3a83c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
                          Filesize

                          4.6MB

                          MD5

                          e8c32cc88db9fef57fd9e2bb6d20f70b

                          SHA1

                          e732b91cd8ac16fa4ce8ad9e639bf21d69f6bb45

                          SHA256

                          f787ce198538b1c0b2bfce8ce5297e34152cf6deebe559df6887f65c72a081a4

                          SHA512

                          077307d42438f2b72d62ce9e35c67c09e1375c2e203e6d6d455c6c8861c6442b3d82f1345b6c76940f5e8015fe93491158a59b102fabd139c742d75c2c42ba7a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe
                          Filesize

                          263B

                          MD5

                          a05e26d89c5be7e2c6408b09cd05cf74

                          SHA1

                          c24231c6301f499b35441615b63db6969a1762fd

                          SHA256

                          05628dfff22e15b219a711cf52a2c87521170853979f00fcd014cf164656418e

                          SHA512

                          8c8733f12dd71cfafd2edbfad487279d6ed971eb119b1cde92a905f4658a9b090f831f42ef2228a4f6c64071a1f54fb74708438b4361e317e36016897577913d

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe.config
                          Filesize

                          357B

                          MD5

                          a2b76cea3a59fa9af5ea21ff68139c98

                          SHA1

                          35d76475e6a54c168f536e30206578babff58274

                          SHA256

                          f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

                          SHA512

                          b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat
                          Filesize

                          48B

                          MD5

                          2fa8decc3dafe6f196f6c28769192e7c

                          SHA1

                          69f4e0cf41b927634a38b77a8816ca58c0bfb2de

                          SHA256

                          7e40eb542d164397c0bf17a47c8f0db79e7028299e9f180d38505220fd2cfb30

                          SHA512

                          c9fb6c2ac2441ff14673ccaa3f1d5e703356c093353992d302d34df6c9e26a85aba6760c3b98f0cd0ada45183c55b2e5cabc09978ca084077dd71743ca9fdbc1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
                          Filesize

                          1.3MB

                          MD5

                          52c95032ff8b8c3d4dfd98e51d8f6f58

                          SHA1

                          e841a32cb07adaad4db35b1f87b5df6e019eb9af

                          SHA256

                          39b35293e7efaa4cb94028e59872013bef4065788fef9fe3cd3206a8aee711e4

                          SHA512

                          a1177740ffbb476fb11f8112d98cabe3012ee3d54f2f848bb22ea99b53bd3526bf59065951fb6ef29f29408ab2fd90c942de65fe16d66a098abce8ba5d7d4e00

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe
                          Filesize

                          227B

                          MD5

                          d47062c8738a534fc931c0f341a61773

                          SHA1

                          c1175037a0e96363da56bc9d8abdb726cddc74fc

                          SHA256

                          484cc22b88e1eaae619f948e96812ebf70275f9e6408e2e3dbd8af827ac5199a

                          SHA512

                          9de6dcf7944ec9f2ff44c8fdbe562a6755c2af9800028b01fb0969921e6ef969c1ecc6e2ab129f191ac5feeaa9aa30cf436489dfee8e94433d6678a9942ffe39

                          Download Submit

                        • \??\c:\Program Files (x86)\Google\Update\CSCB294A08ECF1B454AA0A4EC7C5767AD9E.TMP
                          Filesize

                          1KB

                          MD5

                          1cf17d8bbf1e200a8d469fd7779f7097

                          SHA1

                          741dbad3dc6eb4ccfdaf62faf10616427c5218da

                          SHA256

                          647962db738296ecce417131202e30cfee0e8e9a41667924150b9467189059df

                          SHA512

                          d682c0f25c1db957189422a49040d10a95f23b955ae35730926c8ab8460a9fb6ab45d05629a5236758f29b91f6802893a60a64f23e908ecd629acdff735b354d

                          Download Submit

                        • \??\c:\Program Files\Windows Journal\es-ES\CSCBCD9AEA27EAF42E9ACCB5BE916A50EC.TMP
                          Filesize

                          1KB

                          MD5

                          29c413bfed38632cc7933f8dc2680f4e

                          SHA1

                          942dd6a35e1f38c3079b99dd36197595ca851cd5

                          SHA256

                          e78aed29e0e6933c89b204db39e4f680d6ba2efa05df1b285e3daa6b258b737b

                          SHA512

                          e6b7b85fdd4141d993cf4ad7f63adc6cefb4100673f5ddabeb0b7668c19b3cf9d36c392fd42d50ccbd7204b2cbf455c6775e8b1cfcff19c525ba73004ea00434

                          Download Submit

                        • \??\c:\Program Files\Windows Journal\es-ES\CSCECFBE14FCDC4435A8B936AF24849C8A7.TMP
                          Filesize

                          1KB

                          MD5

                          c4f2ef9fd36b6a1052f5786bfa6dce81

                          SHA1

                          b29de5f454f7e07981bd8fe21bbe79e782c3fbbc

                          SHA256

                          caac8c5ccbcefbacff668e563dd5a415529d1c026d8c9395eaaec6cbd60159e3

                          SHA512

                          9fe6e9919a7e04e267d3d184e1c37cbc1c4c0a976442fd2dcb64b85d0838649bc022f06864ce1a916654aa606533e6d84f204888d8682f003264a4a6b6afaacf

                          Download Submit

                        • \??\c:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\CSCDF4598FDA56A408FB8987B503084CAA6.TMP
                          Filesize

                          1KB

                          MD5

                          169bc6dc73ba66baacdb4d2a953f6ba6

                          SHA1

                          539f14f124f21548bff9e0c4af763cd54fa1527d

                          SHA256

                          bfc43c31534d80937c6af4f8db9a5e05c2982a7db57460cda32d95493f83d5e3

                          SHA512

                          12b3a50df4d7bd16325af7d1e8cf2d4ed29cb6426538550168806b8bb73755f93f1622e60157efb3873ecc70bb1d9dc2e6ad276e7eed4a794af46f50089c969d

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\bdbvphge\bdbvphge.0.cs
                          Filesize

                          382B

                          MD5

                          ebf10330845c44b3c177d8b668837738

                          SHA1

                          e66d6de8cb3af3d29e91fe4fd48a6169a1391ee2

                          SHA256

                          33efbef8a65009903d725451603562c689d588bf6f1ad46f4cd58c03209032be

                          SHA512

                          b8f45164e5343ba931ffb5c5d25717c95934df328186390af1b082de17538259ef28ef5fc9124cbf829f096af1760e99418da613d590df04662d35123b2bf790

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\bdbvphge\bdbvphge.cmdline
                          Filesize

                          252B

                          MD5

                          0d404766005467bc8773b1ccf0859538

                          SHA1

                          d66a36cff5c2f5332781d352cafe007d7ff54311

                          SHA256

                          7cfd34c7e0b39388c7a182adcb409df637e846d14f15dbd17db94a93dd14e041

                          SHA512

                          ade993887bfd2e9a7864453698daa1366d577e2eeca248356022bf0dad3670e67cdc557313fc6f7954be06526422776d31282b487a7bfead2d3ecb6008b600b2

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\k4v3vsrs\k4v3vsrs.0.cs
                          Filesize

                          385B

                          MD5

                          3722810c87af2b34ba28425be33c9d5d

                          SHA1

                          b83568ddf9d4220e8bd6143ee60a06b4279dbd20

                          SHA256

                          ef8834817ab570e1852f2890dc21c8132febe3185dce272a07d478877ce9ab68

                          SHA512

                          817baaf85623ec170692e1f23ae8bba236888e1e83231529a73c89d7a054b428e4c510a345e1a986940b363b6411cb9fb1ad0630d1a03b2253ab3d478427753e

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\k4v3vsrs\k4v3vsrs.cmdline
                          Filesize

                          255B

                          MD5

                          7cb6fc1429f1e5150ce850b6dc5b6218

                          SHA1

                          9ac2be42f118cac935475637ae098fe30447dc30

                          SHA256

                          f249d0afe556f37fa81d7ae6073d3ff77eed9c93b0746195424eff5f59a56084

                          SHA512

                          852bc2398dfc7fc193f7dff53cde7b909ec1eee777c452162d4d30fbd6933f986330c9e1a9078f94846543793809b6f6bf147b7a3d891f0c6cf531962cb5c495

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\o0la155j\o0la155j.0.cs
                          Filesize

                          379B

                          MD5

                          208247e9682acc7bda97b01f497bfeaf

                          SHA1

                          d7e22e7bf51cdb4b4d1b0da784f4997edebdb99c

                          SHA256

                          cc63091727fa4ac20588a68441f694614d820b55e726ea74f695509f32afeb03

                          SHA512

                          0714d22c4a7826028bc320850717139d4cf608b7eac482a9a128055b9698597387f3449ebcecdf76c5420ac94eb0a4babeb928742790438007a6a62e5f5c0127

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\o0la155j\o0la155j.cmdline
                          Filesize

                          249B

                          MD5

                          e614d07c56b473bd80c3b37efd62c37b

                          SHA1

                          c626c058f10462131fbb847ca2ecb36e669880df

                          SHA256

                          fe54e21a98ed0eed140c0b804a841e6fb60bee2770e3789e55824761dcaf9b01

                          SHA512

                          09b3282b701212e5ae86ef7eb9d51286db9807915db2ab3c980e2c135ff5bb4ea0772a4ebbc31b30c7cb3dd5df7a0948c156dd03f605750f572f868ee5561d2a

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\w2lijukn\w2lijukn.0.cs
                          Filesize

                          365B

                          MD5

                          d3c6b415608c71e76aacf5609a152885

                          SHA1

                          e8dfd0bc24129b78eeef5ae84a5ea10228c163ae

                          SHA256

                          c3f8e24c35f3930a45e27eab3f4f5fccb010cb0a2e0210896b7b5b90393dec4d

                          SHA512

                          8d0a81f826b7b6d798ef09b453a0e8c6e5a6bfe411b378e2a68e6c6250d54adad998878c4901fa1dfa6ca9d47c8998ca9501992b38611dff4d63708f79b5b5b7

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\w2lijukn\w2lijukn.cmdline
                          Filesize

                          235B

                          MD5

                          9fb9d5cadc8c84ddef72a8c383ced1d8

                          SHA1

                          8c51c46a7e3376d42852971ac0a9c9cd1edfb705

                          SHA256

                          2bb89cd8293c6d00440d955b65366185388cffa206447128f57b59e1623c9716

                          SHA512

                          753fcb24215e3354300f3af2b92cc977d88f7877104c8b553065619d9e64740f668d94fb255b956e902df985ec6c125f96c46dbf4e0518f183508739f5077437

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\ygc2l3uy\ygc2l3uy.0.cs
                          Filesize

                          395B

                          MD5

                          4d72a19b75610bb3cd347e3a7f20b05b

                          SHA1

                          1fc3e39e5f006dfc429ed5de6a6551792bfccf61

                          SHA256

                          c5394f5c65eda58064be34be057e9cd2b4df13cc9fa4fe8ca48a8cfe3c54d283

                          SHA512

                          48443e8d89a017c586b0beddafee33a484e2d2310411fd56d398f105fd76faa3b652715fc29e69b061290576fa4c433111c42a19e802de2f18389ced41971956

                          Download Submit

                        • \??\c:\Users\Admin\AppData\Local\Temp\ygc2l3uy\ygc2l3uy.cmdline
                          Filesize

                          265B

                          MD5

                          8791a662203468ab6ca46f5c62796633

                          SHA1

                          b7b043a6604487f806f93258cf589f121fe2c5d1

                          SHA256

                          c6e97d67289a3eb5eac699076583f03a0684b621ce68140a4a8fcba6afb69ae5

                          SHA512

                          0c99adf6e7bc01c3b98848ced079cb48bf05a6a0286a04b8e9262a74505161523c89634d1ea6d7bf772020a102ac03ac32b1f2c67327eed864981a302e3b01e2

                          Download Submit

                        • \??\c:\Windows\System32\CSCBED0F9ED82C54A17AD3DCC7519D1C35D.TMP
                          Filesize

                          1KB

                          MD5

                          332eb1c3dc41d312a6495d9ea0a81166

                          SHA1

                          1d5c1b68be781b14620d9e98183506f8651f4afd

                          SHA256

                          bab20fa8251fcee3c944e76bdc082850ae4a32fd2eff761fec3bc445f58d11f2

                          SHA512

                          2c5ae1de2d4cb7f1e1540b455f7876eb1f494cda57bfb8e78a81aa01f3f453c5488b986cd170d6dc96bf684874c54257bfd0335a78764cc3fa43fe310a0cf440

                          Download Submit

                        • \Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
                          Filesize

                          3.0MB

                          MD5

                          10e817a4d5e216279a8de8ed71c91044

                          SHA1

                          97c6fb42791be24d12bd74819ef67fa8f3d21724

                          SHA256

                          c60f74f6e164049e683a5f01b8cfea24aa85cbf6c7b31b765cbad16d8ab0d7b2

                          SHA512

                          34421a517f5f1909afd694d24e22cafad9930725df964ba9c80666e9f0f2dcfdd2a254dcf6699e5797296ec3ae611593563779df05e3a617c7f8679a154dfd37

                          Download Submit

                        • \Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
                          Filesize

                          556KB

                          MD5

                          00c4245522082b7f87721f9a26e96ba4

                          SHA1

                          993a8aa88436b6c62b74bb399c09b8d45d9fb85b

                          SHA256

                          a728f531427d89c5b7691f989e886df57d46f90d934448e6dabf29d64d0662bf

                          SHA512

                          fdd8d2444b28883face793f6ea77913c2096a425e6101202536ea001c3df5e76a60a01673ee7a52eae827a12299b2727002895395315db190ec82ae11a68559f

                          Download Submit

                        • memory/484-289-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/536-99-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1020-467-0x0000000000E50000-0x000000000114E000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/1284-395-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1284-394-0x000000001B660000-0x000000001B942000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/1636-385-0x0000000001E10000-0x0000000001E18000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1636-383-0x000000001B6B0000-0x000000001B992000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/1960-416-0x0000000000AD0000-0x0000000000C2A000-memory.dmp

                          Filesize

                          1.4MB

                          Download

                        • memory/2080-417-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2112-297-0x00000000009E0000-0x0000000000B3A000-memory.dmp

                          Filesize

                          1.4MB

                          Download

                        • memory/2136-140-0x00000000001E0000-0x00000000001F6000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/2136-115-0x0000000000E10000-0x0000000000F6A000-memory.dmp

                          Filesize

                          1.4MB

                          Download

                        • memory/2136-139-0x00000000001C0000-0x00000000001DC000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/2136-143-0x0000000000460000-0x000000000046C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2136-142-0x0000000000450000-0x000000000045E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2136-141-0x0000000000420000-0x0000000000430000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2192-125-0x0000000000410000-0x000000000041E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2192-136-0x0000000000520000-0x000000000052E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2192-138-0x0000000000A60000-0x0000000000A6C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2192-130-0x00000000004F0000-0x00000000004FE000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2192-132-0x0000000000500000-0x000000000050C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2192-127-0x00000000004E0000-0x00000000004EC000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2192-123-0x00000000004C0000-0x00000000004D8000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/2192-134-0x0000000000510000-0x000000000051C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2192-121-0x0000000000420000-0x000000000043C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/2192-119-0x00000000001C0000-0x00000000001CE000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2192-106-0x0000000000F60000-0x0000000000F68000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2192-107-0x000000001AE30000-0x000000001AF34000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/2204-74-0x0000000000110000-0x000000000040E000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2204-75-0x0000000000700000-0x0000000000712000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/2204-76-0x00000000045E0000-0x000000000462E000-memory.dmp

                          Filesize

                          312KB

                          Download

                        • memory/2224-267-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2224-273-0x0000000001F70000-0x0000000001F78000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2412-50-0x0000000004890000-0x0000000005284000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/2448-90-0x0000000000810000-0x0000000000B0E000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2568-62-0x0000000000400000-0x0000000000DF4000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/2568-51-0x0000000000400000-0x0000000000DF4000-memory.dmp

                          Filesize

                          10.0MB

                          Download

                        • memory/2580-316-0x000000001B560000-0x000000001B842000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2580-317-0x00000000028E0000-0x00000000028E8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2696-468-0x0000000000210000-0x000000000050E000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2712-60-0x0000000000380000-0x000000000038E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2712-63-0x0000000000570000-0x0000000000582000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/2712-58-0x0000000000C90000-0x0000000000F8E000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2712-61-0x0000000000460000-0x00000000004BC000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/2776-81-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2776-117-0x0000000000890000-0x00000000008A8000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/2776-85-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2776-384-0x0000000005230000-0x0000000005232000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2776-83-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2776-88-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2776-86-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2776-350-0x0000000004E70000-0x0000000004E7E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/2776-79-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2776-87-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2776-116-0x00000000007F0000-0x0000000000802000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/2776-128-0x0000000000970000-0x0000000000980000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2776-77-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2928-296-0x0000000000820000-0x0000000000828000-memory.dmp

                          Filesize

                          32KB

                          Download