Overview

overview

10

Static

static

3

GameHackBu...in.exe

windows7-x64

10

GameHackBu...in.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2025 12:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GameHackBuild1.exe.bin.exe

  • Size

    9.0MB

  • MD5

    35a0fbec2fc6d2a550a569719406d58d

  • SHA1

    bc73001a0600313803d3594dc51d3d0813dbdec1

  • SHA256

    221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d

  • SHA512

    2f4d71eaa62dded749f82660fd7ee90da422048459d63faa79f518c3c10b7343c482e95cf81cea6bfb4710ef07f53d2d7f835dd3f191029da38da2e9a7beb00f

  • SSDEEP

    196608:uGk5oFaEPX2GgYCCUDQ4yA8/vWOCFidWo+QOovFFoJXz0Bt99OGvFLuyAjA9UCo:9k5/EP2Gac4yHndWo+bodFgXz29OGNps

Score
10/10
dcratorcusgamehackdiscoveryexecutioninfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

GameHack

C2

31.44.184.52:25350

Mutex

sudo_06kkh814g4vz7sfklrh1emcow75dz383

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\Windows\Defender\MpDefenderCoreProtion.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 26 IoCs
    persistence
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Orcurs Rat Executable 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\GameHackBuild1.exe.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\GameHackBuild1.exe.bin.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
          "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2248
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gxqun3yq\gxqun3yq.cmdline"
            5⤵
            • Drops file in Program Files directory
            PID:2508
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES736B.tmp" "c:\Program Files\Windows Photo Viewer\en-US\CSC26E9B39D213245928B931B4D3D3897.TMP"
              6⤵
                PID:3048
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vyynnwny\vyynnwny.cmdline"
              5⤵
                PID:2512
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7417.tmp" "c:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\CSCC87458AC71914A5D9817B7C12DDC47EA.TMP"
                  6⤵
                    PID:2028
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1gnpojgr\1gnpojgr.cmdline"
                  5⤵
                  • Drops file in System32 directory
                  PID:1080
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7494.tmp" "c:\Windows\System32\CSC8AF8654FC13D48D0A5FAAA4B8D729FE.TMP"
                    6⤵
                      PID:1592
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2096
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\containerRuntime.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1552
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2400
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\conhost.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2088
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\audiodg.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3052
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1228
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MErU4jTVhT.bat"
                    5⤵
                      PID:2724
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        6⤵
                          PID:2408
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          6⤵
                            PID:1724
                          • C:\Users\Public\Documents\containerRuntime.exe
                            "C:\Users\Public\Documents\containerRuntime.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3280
                  • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
                    "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2836
                    • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                      "C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1776
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:644
                  • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
                    "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2756
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2044
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "
                        4⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2284
                        • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
                          "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
                          5⤵
                          • DcRat
                          • Modifies WinLogon for persistence
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in Program Files directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1960
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe'
                            6⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2380
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'
                            6⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2184
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\taskeng.exe'
                            6⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1908
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ioi08Taqru.bat"
                            6⤵
                              PID:1560
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                7⤵
                                  PID:2524
                                • C:\Program Files\Windows Photo Viewer\en-US\conhost.exe
                                  "C:\Program Files\Windows Photo Viewer\en-US\conhost.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:2828
                                  • C:\Windows\BitLockerDiscoveryVolumeContents\System.exe
                                    "C:\Windows\BitLockerDiscoveryVolumeContents\System.exe"
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2512
                                  • C:\Program Files\Windows Photo Viewer\en-US\conhost.exe.exe
                                    "C:\Program Files\Windows Photo Viewer\en-US\conhost.exe.exe"
                                    8⤵
                                    • Modifies WinLogon for persistence
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1776
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2736
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\conhost.exe.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:620
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\MSBuild.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1752
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1980
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2264
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2496
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\audiodg.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1404
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:768
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Favorites\lsass.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1476
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2692
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3064
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2596
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2984
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\taskhost.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2776
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2180
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\conhost.exe.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1296
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\templates\audiodg.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1324
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:696
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\lib\dwm.exe'
                                      9⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:912
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cs9AbqBBxW.bat"
                                      9⤵
                                        PID:536
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          10⤵
                                            PID:3288
                                          • C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe
                                            "C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe"
                                            10⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3640
                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
                            "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:2616
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {066F2BB1-C4A8-49BB-B79F-115FB55365A8} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1484
                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:1284
                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4036
                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2288
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          PID:3032
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3040
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\en-US\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:988
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskengt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\taskeng.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1540
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskeng" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\taskeng.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1900
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskengt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\taskeng.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:896
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2920
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2672
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2492
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "containerRuntimec" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\containerRuntime.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1736
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "containerRuntime" /sc ONLOGON /tr "'C:\Users\Public\Documents\containerRuntime.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1716
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "containerRuntimec" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\containerRuntime.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2000
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:620
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2496
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2252
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\conhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2804
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2696
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2124
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\Default\audiodg.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2888
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:676
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Default\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1608
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:316
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "runtimesvc" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1928
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:860
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost.exec" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\conhost.exe.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2424
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost.exe" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1476
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost.exec" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\conhost.exe.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2264
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuildM" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\MSBuild.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2004
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuild" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\MSBuild.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2896
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "MSBuildM" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\MSBuild.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2664
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3064
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1692
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1596
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2968
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3060
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:696
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1248
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3044
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1956
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\audiodg.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2884
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1612
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2688
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1728
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:316
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2980
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Favorites\lsass.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          PID:2420
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Favorites\lsass.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:636
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Favorites\lsass.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2780
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2408
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2932
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1428
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2920
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2516
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:1132
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:956
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2632
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1540
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          PID:2056
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2744
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2184
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\taskhost.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3004
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2768
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2072
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f
                          1⤵
                          • DcRat
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:884
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:2508
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:1712
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost.exec" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\conhost.exe.exe'" /f
                          1⤵
                          • DcRat
                          PID:748
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost.exe" /sc ONLOGON /tr "'C:\Windows\de-DE\conhost.exe.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:1144
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost.exec" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\conhost.exe.exe'" /rl HIGHEST /f
                          1⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2528
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\security\templates\audiodg.exe'" /f
                          1⤵
                          • DcRat
                          • Scheduled Task/Job: Scheduled Task
                          PID:1096
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\security\templates\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • DcRat
                          PID:584
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Windows\security\templates\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                            PID:2540
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /f
                            1⤵
                            • DcRat
                            • Scheduled Task/Job: Scheduled Task
                            PID:2668
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
                            1⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:3020
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
                            1⤵
                            • DcRat
                            • Scheduled Task/Job: Scheduled Task
                            PID:2848
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre7\lib\dwm.exe'" /f
                            1⤵
                            • DcRat
                            • Scheduled Task/Job: Scheduled Task
                            PID:2252
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\dwm.exe'" /rl HIGHEST /f
                            1⤵
                            • DcRat
                            • Scheduled Task/Job: Scheduled Task
                            PID:2708
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre7\lib\dwm.exe'" /rl HIGHEST /f
                            1⤵
                            • DcRat
                            • Scheduled Task/Job: Scheduled Task
                            PID:2396

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Winlogon Helper DLL

                          1
                          T1547.004

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Winlogon Helper DLL

                          1
                          T1547.004

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Discovery

                          Query Registry

                          1
                          T1012

                          System Information Discovery

                          1
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files\Windows Photo Viewer\en-US\conhost.exe
                            Filesize

                            4KB

                            MD5

                            99f99dbcac6ebfe7231243248eb4c34f

                            SHA1

                            20f998db1d91e6ee20814e803554627d739d8f83

                            SHA256

                            6fcd69e020f0dabc08164a755454aa5ba19f5f5ca1ac91d40f182909d47ef3c9

                            SHA512

                            d43baaa22b625d0ddbdeb2fd2088811b2588d9e494234374c69b377ea73946ace9d51cf355881b6d503dc2d0c4d56e8a6538149e43ce096a9f417c4a2bbb9bcc

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\MErU4jTVhT.bat
                            Filesize

                            222B

                            MD5

                            48bd5ce29bcc06b7a9277d27483ac2a2

                            SHA1

                            1f4706bbd7b583db0da605ceb72c7cca973ca0b4

                            SHA256

                            0982f42e22fd38096c43af177b73066155e02d49fff1b483d04dec0bc0eca60a

                            SHA512

                            c9128e042253404c29c74125342b6e6e9272847df23e37e65e5d6921dea352ad4168f224e30b2e0944806f6f943fc9cd06ae61cd92dc87306cbb127810eab4cf

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\RES736B.tmp
                            Filesize

                            1KB

                            MD5

                            22c23a8104bfd0a9797b6a1c39c243ff

                            SHA1

                            6c839ded71ccbf4d1915696e6ac50d4d1e5f31ab

                            SHA256

                            addb6332e532fc6f45d89588fbf3a2e9f67dd7bcaed1cd62b05b1c1885792177

                            SHA512

                            e3b442d4c30e93631b373d21c9f66b37b03fbf67c9bbdb19cef88fae858e120e1c174ed89cd8aa7a451e61eb4e04ed646f6371af456ca4d7d91dc4f844390b6b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\RES7417.tmp
                            Filesize

                            1KB

                            MD5

                            30db2e0ee295e54b76f28c0d43c32b9d

                            SHA1

                            116c80fdae2985c43dffc82bbcac38663e0e3be8

                            SHA256

                            cfee47f43e2830c3598f2677ff476f90db6a5a67658811e624f45a7ab79170ad

                            SHA512

                            47e96cb332907b095fb2495d5d1d1db357a6e585b8f32a128ba519dc83108206357891d98aa37027df7ff1760b932cacd43064f0e86743d8098d242db0371f67

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\RES7494.tmp
                            Filesize

                            1KB

                            MD5

                            98cdb9ff1adfd1ea456cef86b0337bc7

                            SHA1

                            7675b90f1ec5a2d5ea1ae2484a55f0fb316f5b3d

                            SHA256

                            9ebe5c5bc368f14caa5a3d72f024ce4f55a6b50346a115ec91d71864e7f2738f

                            SHA512

                            606d7c1bce8dd4c710fa680ff2307eeff07f4c8a0d895d2a754c3fc95112de4287a04d1dbf015347bedef517c0687fefdf7505258bada5f741d2f8f11d73ff39

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ioi08Taqru.bat
                            Filesize

                            220B

                            MD5

                            1136ecc0a95a58dfd27f6f032f11ebad

                            SHA1

                            73f44996f101096ccdb8ec1a075eaf3833ffc406

                            SHA256

                            8e9aed3bc0a39c8a1ad1f118169d5b11c132c1e9d4ba1c5869f14738b88770ba

                            SHA512

                            9dea9cc4bbd082655406c02283eccd79d3b2fae27d80cb0d95359e94ecf75d9b2ca85f96d903678b1bcbbba6be9482633ba828f972ec1515df765dcdbd4ae6e0

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                            Filesize

                            7KB

                            MD5

                            41aeb53342ad5483bee1456b152ba0a3

                            SHA1

                            133d14548698cd00caa892608ff527191c0092cf

                            SHA256

                            3a65dcedb6a184e0c22e45359b513b76ee0165c83e8db574220fc88cc342b7d6

                            SHA512

                            b73a28a19f904ac0066b8fa9a41473c99d51d985c6e7cbc2c919aea31467b722ae0ceaed73a0caead9e35497627c3045b21ce7d85e4a89e5a4dd28924ebdcc18

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                            Filesize

                            7KB

                            MD5

                            dc98ca6ba78dd79031b468b4810e38dc

                            SHA1

                            bf220e9ea3ea7a1d3f56b3b9169aded481a9f5c0

                            SHA256

                            c9cb635c1deef0897eb9b3ef25bdf3df7ccce08b1a7001e389014779cae05f03

                            SHA512

                            1bb0b4414b9c7737dd94bac9ca602ad4221d00e66db2b2d6baf41b6282f317805fcc356f02bc37be5fab49787fdd90d1c1fd5211ef1dd58376ff157692c207c9

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat
                            Filesize

                            104B

                            MD5

                            fbef3b76368e503dca520965bb79565f

                            SHA1

                            9a1a27526b8b9bdaae81c5301cd23eb613ea62ba

                            SHA256

                            bcb2af67a4ea1e6aa341cf3141941dbe7b17f1911e7f20aba46552571f99c9f3

                            SHA512

                            2b99bc9a945b6d9a2c0d3206dce9221eb7f4a2040c5096909d60c3278254c52b39a28dd18dd4e005eff0ebd7e7cba6dd3a6a94ea8a7d7598da3001da174db3f5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
                            Filesize

                            1.6MB

                            MD5

                            bc7804fca6dd09b4f16e86d80b8d28fa

                            SHA1

                            a04800b90db1f435dd1ac723c054b14d6dd16c8a

                            SHA256

                            1628864ab0bafe8afea2ad70956b653550dab3db7c4cdf6f405e93a6c2441dce

                            SHA512

                            7534ac0a215f02af85bdf2b414e23face0570943f8820e7bfe97ea274ccd1a01618556e93b7465c2d9fbb0bcde5e97fab9e9b6bddd366554277ef308cde3a83c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
                            Filesize

                            4.6MB

                            MD5

                            e8c32cc88db9fef57fd9e2bb6d20f70b

                            SHA1

                            e732b91cd8ac16fa4ce8ad9e639bf21d69f6bb45

                            SHA256

                            f787ce198538b1c0b2bfce8ce5297e34152cf6deebe559df6887f65c72a081a4

                            SHA512

                            077307d42438f2b72d62ce9e35c67c09e1375c2e203e6d6d455c6c8861c6442b3d82f1345b6c76940f5e8015fe93491158a59b102fabd139c742d75c2c42ba7a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe
                            Filesize

                            263B

                            MD5

                            a05e26d89c5be7e2c6408b09cd05cf74

                            SHA1

                            c24231c6301f499b35441615b63db6969a1762fd

                            SHA256

                            05628dfff22e15b219a711cf52a2c87521170853979f00fcd014cf164656418e

                            SHA512

                            8c8733f12dd71cfafd2edbfad487279d6ed971eb119b1cde92a905f4658a9b090f831f42ef2228a4f6c64071a1f54fb74708438b4361e317e36016897577913d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
                            Filesize

                            556KB

                            MD5

                            00c4245522082b7f87721f9a26e96ba4

                            SHA1

                            993a8aa88436b6c62b74bb399c09b8d45d9fb85b

                            SHA256

                            a728f531427d89c5b7691f989e886df57d46f90d934448e6dabf29d64d0662bf

                            SHA512

                            fdd8d2444b28883face793f6ea77913c2096a425e6101202536ea001c3df5e76a60a01673ee7a52eae827a12299b2727002895395315db190ec82ae11a68559f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe.config
                            Filesize

                            357B

                            MD5

                            a2b76cea3a59fa9af5ea21ff68139c98

                            SHA1

                            35d76475e6a54c168f536e30206578babff58274

                            SHA256

                            f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

                            SHA512

                            b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat
                            Filesize

                            48B

                            MD5

                            2fa8decc3dafe6f196f6c28769192e7c

                            SHA1

                            69f4e0cf41b927634a38b77a8816ca58c0bfb2de

                            SHA256

                            7e40eb542d164397c0bf17a47c8f0db79e7028299e9f180d38505220fd2cfb30

                            SHA512

                            c9fb6c2ac2441ff14673ccaa3f1d5e703356c093353992d302d34df6c9e26a85aba6760c3b98f0cd0ada45183c55b2e5cabc09978ca084077dd71743ca9fdbc1

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe
                            Filesize

                            227B

                            MD5

                            d47062c8738a534fc931c0f341a61773

                            SHA1

                            c1175037a0e96363da56bc9d8abdb726cddc74fc

                            SHA256

                            484cc22b88e1eaae619f948e96812ebf70275f9e6408e2e3dbd8af827ac5199a

                            SHA512

                            9de6dcf7944ec9f2ff44c8fdbe562a6755c2af9800028b01fb0969921e6ef969c1ecc6e2ab129f191ac5feeaa9aa30cf436489dfee8e94433d6678a9942ffe39

                            Download Submit

                          • \??\c:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\CSCC87458AC71914A5D9817B7C12DDC47EA.TMP
                            Filesize

                            1KB

                            MD5

                            beb071b378f7255ac19ff7e7e3135f6e

                            SHA1

                            a09191db7295117df513f121d892c08f11b46eaa

                            SHA256

                            a5c200a254b1c109dca75f477188c7fc29a2876874ea4aadfd5df94903f39e7f

                            SHA512

                            5bb54a1fb6f68f147c4a9fc170f8ae12cc5e94d2fcfe241bf262a771af4c0e8352dc1bcb9157c63696dc2a2407d15c5ef14d0213ac79b44b4092128924747a82

                            Download Submit

                          • \??\c:\Program Files\Windows Photo Viewer\en-US\CSC26E9B39D213245928B931B4D3D3897.TMP
                            Filesize

                            1KB

                            MD5

                            169bc6dc73ba66baacdb4d2a953f6ba6

                            SHA1

                            539f14f124f21548bff9e0c4af763cd54fa1527d

                            SHA256

                            bfc43c31534d80937c6af4f8db9a5e05c2982a7db57460cda32d95493f83d5e3

                            SHA512

                            12b3a50df4d7bd16325af7d1e8cf2d4ed29cb6426538550168806b8bb73755f93f1622e60157efb3873ecc70bb1d9dc2e6ad276e7eed4a794af46f50089c969d

                            Download Submit

                          • \??\c:\Users\Admin\AppData\Local\Temp\1gnpojgr\1gnpojgr.0.cs
                            Filesize

                            386B

                            MD5

                            85f873c32493eb4186341a57c58191d7

                            SHA1

                            a5b931237f2c21cf2c62a8990fdb7a49e10a1617

                            SHA256

                            b31e812da734042bc2326b9bd76927d4d74162adfd4983f66e0d606050aab5f2

                            SHA512

                            2590fc305befbc9e416dd6ed2f01d749c9155f6ffd44c9095d8f6565f5c9583ec99c923ac2ac0a81e462709122e36d43a7bee0354ba08caba5d853d569048eed

                            Download Submit

                          • \??\c:\Users\Admin\AppData\Local\Temp\1gnpojgr\1gnpojgr.cmdline
                            Filesize

                            235B

                            MD5

                            39e12c261d8c72139db68570730a10b8

                            SHA1

                            2fae6b6609ef6e9974e6e2c47d7bdb6f003ef80b

                            SHA256

                            d6a318a2cee117d658e844ca31f71c84e4dd50535cfd1513580ad0eb84c90958

                            SHA512

                            bee89d89e7f37d0a3f22f4f625faa23eaa018879a5c4e9058c48dc6087ac8c53a35fbcda24a1437c6c950736dd22886b908f1fb7203e477edeffbda605e1e6b1

                            Download Submit

                          • \??\c:\Users\Admin\AppData\Local\Temp\gxqun3yq\gxqun3yq.0.cs
                            Filesize

                            411B

                            MD5

                            b44da4c0f825b7f761030505c6da6b66

                            SHA1

                            28b66051b40e3984435176efec7937fa759f3cd2

                            SHA256

                            9dc450cf1df0857e9dd71d3f2b40c34406b1c105fa7249f6348ebb0a3541c9d2

                            SHA512

                            6e15eb38d5af1c5db5bedb2d237325bd2ea02cf27425b94756855cc87e35dd4e58aca7c58f9b5270d214bed93e4d97e6eec26b8f52f2825533fb42420bfb4a7a

                            Download Submit

                          • \??\c:\Users\Admin\AppData\Local\Temp\gxqun3yq\gxqun3yq.cmdline
                            Filesize

                            260B

                            MD5

                            cd3788eb7c2c86243f992312c67107b3

                            SHA1

                            9178ef7a189f35170d73c92dab567b61d360e9e2

                            SHA256

                            972cecaaac083d67b19fd297bf2128f4e78ba9aa76e2a76e11be2b434da8deba

                            SHA512

                            daeaf512a6fb3142edb623f50b8e16a65371f3e08e3f044740df39f604303d08ed5c3cc9e2d9b2de163e9ee7ddb09dc00050e67697084b624ca874492a43ee73

                            Download Submit

                          • \??\c:\Users\Admin\AppData\Local\Temp\vyynnwny\vyynnwny.0.cs
                            Filesize

                            435B

                            MD5

                            54dcbd4cddc517ecf37e0738b96eb246

                            SHA1

                            a4ec223c69bc253b988d8ec4b8c928befa0d2009

                            SHA256

                            cc72bbe28417b4950c994ac979c5073ea0ef7cb35f586519b26181bc0115a806

                            SHA512

                            06a5dcb095311d1ae84ab764d5ec6f10ce1f99dbbcebdb8fa0f6de3dd41be15a281755a147dbb69843ca7575bb100ba2d7851070410667e0a4c4c837c32110ec

                            Download Submit

                          • \??\c:\Users\Admin\AppData\Local\Temp\vyynnwny\vyynnwny.cmdline
                            Filesize

                            284B

                            MD5

                            b40aa1c5723fa72cb06ab486fa83ab33

                            SHA1

                            ee3b6ccbbd01cfcee0a7d63c6dd886ed4c5fe106

                            SHA256

                            b77cddb52ce374967212c3daea38254c412c4d51581c8b77a9ccfc9b0bcfc5c6

                            SHA512

                            83d1ce6faec96c30056790d520f6d2ee1dd598bdcf5ef0dbc81b1e06582422b3de15c0ae051bc57579b70b562dad1a651f077a62b9e4508eb77b784f17d86969

                            Download Submit

                          • \??\c:\Windows\System32\CSC8AF8654FC13D48D0A5FAAA4B8D729FE.TMP
                            Filesize

                            1KB

                            MD5

                            8c85ef91c6071d33745325a8fa351c3e

                            SHA1

                            e3311ceef28823eec99699cc35be27c94eca52d2

                            SHA256

                            8db3e3a5515da1933036688a9b1918cfc3339fc687008c5325461271904b2d41

                            SHA512

                            2bb89b07fe46b1c406ed6a560e88cb2b8402b1d61bb71e10887bad661751f64f1e5317fd6c1b301ea4766785b915da31b64e0475cfe36c1f950b32915b5dab7d

                            Download Submit

                          • \Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
                            Filesize

                            3.0MB

                            MD5

                            10e817a4d5e216279a8de8ed71c91044

                            SHA1

                            97c6fb42791be24d12bd74819ef67fa8f3d21724

                            SHA256

                            c60f74f6e164049e683a5f01b8cfea24aa85cbf6c7b31b765cbad16d8ab0d7b2

                            SHA512

                            34421a517f5f1909afd694d24e22cafad9930725df964ba9c80666e9f0f2dcfdd2a254dcf6699e5797296ec3ae611593563779df05e3a617c7f8679a154dfd37

                            Download Submit

                          • \Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
                            Filesize

                            1.3MB

                            MD5

                            52c95032ff8b8c3d4dfd98e51d8f6f58

                            SHA1

                            e841a32cb07adaad4db35b1f87b5df6e019eb9af

                            SHA256

                            39b35293e7efaa4cb94028e59872013bef4065788fef9fe3cd3206a8aee711e4

                            SHA512

                            a1177740ffbb476fb11f8112d98cabe3012ee3d54f2f848bb22ea99b53bd3526bf59065951fb6ef29f29408ab2fd90c942de65fe16d66a098abce8ba5d7d4e00

                            Download Submit

                          • memory/644-88-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/644-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/644-90-0x0000000000DE0000-0x0000000000DF8000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/644-78-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/644-91-0x0000000002390000-0x00000000023A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/644-80-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/644-82-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/644-86-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/644-76-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/644-85-0x0000000000400000-0x00000000006FE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1552-220-0x0000000002180000-0x0000000002188000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/1552-218-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/1684-47-0x0000000004620000-0x0000000005014000-memory.dmp

                            Filesize

                            10.0MB

                            Download

                          • memory/1776-75-0x0000000000C20000-0x0000000000C6E000-memory.dmp

                            Filesize

                            312KB

                            Download

                          • memory/1776-74-0x00000000013C0000-0x00000000016BE000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/1776-249-0x0000000000140000-0x000000000029A000-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1960-113-0x00000000002E0000-0x00000000002F0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1960-112-0x0000000000300000-0x0000000000316000-memory.dmp

                            Filesize

                            88KB

                            Download

                          • memory/1960-128-0x0000000000790000-0x000000000079E000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/1960-129-0x00000000007A0000-0x00000000007AC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/1960-109-0x00000000002C0000-0x00000000002DC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/1960-104-0x0000000001170000-0x00000000012CA000-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/2184-164-0x00000000022C0000-0x00000000022C8000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/2248-119-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/2248-111-0x0000000000C90000-0x0000000000CA8000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/2248-127-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/2248-125-0x0000000000CE0000-0x0000000000CEE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/2248-123-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/2248-121-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/2248-98-0x000000001AB90000-0x000000001AC94000-memory.dmp

                            Filesize

                            1.0MB

                            Download

                          • memory/2248-117-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/2248-115-0x0000000000AC0000-0x0000000000ACE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/2248-106-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/2248-97-0x0000000001180000-0x0000000001188000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/2248-108-0x0000000000AE0000-0x0000000000AFC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/2264-308-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/2380-163-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/2512-248-0x0000000000970000-0x0000000000978000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/2616-60-0x0000000000400000-0x0000000000DF4000-memory.dmp

                            Filesize

                            10.0MB

                            Download

                          • memory/2616-48-0x0000000000400000-0x0000000000DF4000-memory.dmp

                            Filesize

                            10.0MB

                            Download

                          • memory/2828-244-0x00000000013A0000-0x00000000013A8000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/2836-58-0x0000000001210000-0x000000000150E000-memory.dmp

                            Filesize

                            3.0MB

                            Download

                          • memory/2836-61-0x00000000005F0000-0x00000000005FE000-memory.dmp

                            Filesize

                            56KB

                            Download

                          • memory/2836-62-0x0000000000A00000-0x0000000000A5C000-memory.dmp

                            Filesize

                            368KB

                            Download

                          • memory/2836-63-0x0000000000AE0000-0x0000000000AF2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/3280-378-0x0000000000A70000-0x0000000000A78000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/3640-379-0x0000000000A60000-0x0000000000BBA000-memory.dmp

                            Filesize

                            1.4MB

                            Download