Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 16:43

General

  • Target

    HEUR.Trojan-Spy.MSIL.Stealer.exe

  • Size

    1.3MB

  • MD5

    20043020e5b82ce7e3d69c407a85e50c

  • SHA1

    1502bdf6ccaa56c45716852cd1be8552d2cfa52c

  • SHA256

    40603df340cee8c3d00939469470a28acbf64401ec12d32ba68fe54e7f04c6d4

  • SHA512

    d62a363bcddd24bcb7d2e92f4fe5c1f6347560db439f83499973de59462605645c6b89d720eb768275da34bdecb715381471f14d0767e1e727684379535548d6

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 36 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR.Trojan-Spy.MSIL.Stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR.Trojan-Spy.MSIL.Stealer.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4196
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4128
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3240
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4504
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1828
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2472
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2976
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1412
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4336
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3596
          • C:\Windows\es-ES\Idle.exe
            "C:\Windows\es-ES\Idle.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3580
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:404
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3316
                • C:\Windows\es-ES\Idle.exe
                  "C:\Windows\es-ES\Idle.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1500
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zlmto9DLwM.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1440
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:2216
                      • C:\Windows\es-ES\Idle.exe
                        "C:\Windows\es-ES\Idle.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1332
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:216
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:708
                            • C:\Windows\es-ES\Idle.exe
                              "C:\Windows\es-ES\Idle.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4072
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:592
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:2332
                                  • C:\Windows\es-ES\Idle.exe
                                    "C:\Windows\es-ES\Idle.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2096
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2924
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:232
                                        • C:\Windows\es-ES\Idle.exe
                                          "C:\Windows\es-ES\Idle.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3612
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"
                                            16⤵
                                              PID:4200
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                17⤵
                                                  PID:4092
                                                • C:\Windows\es-ES\Idle.exe
                                                  "C:\Windows\es-ES\Idle.exe"
                                                  17⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4352
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OrAhl4fNEA.bat"
                                                    18⤵
                                                      PID:1740
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        19⤵
                                                          PID:2300
                                                        • C:\Windows\es-ES\Idle.exe
                                                          "C:\Windows\es-ES\Idle.exe"
                                                          19⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4784
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat"
                                                            20⤵
                                                              PID:808
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                21⤵
                                                                  PID:2008
                                                                • C:\Windows\es-ES\Idle.exe
                                                                  "C:\Windows\es-ES\Idle.exe"
                                                                  21⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3768
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat"
                                                                    22⤵
                                                                      PID:4996
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        23⤵
                                                                          PID:2472
                                                                        • C:\Windows\es-ES\Idle.exe
                                                                          "C:\Windows\es-ES\Idle.exe"
                                                                          23⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4776
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat"
                                                                            24⤵
                                                                              PID:1164
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                25⤵
                                                                                  PID:1448
                                                                                • C:\Windows\es-ES\Idle.exe
                                                                                  "C:\Windows\es-ES\Idle.exe"
                                                                                  25⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2304
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
                                                                                    26⤵
                                                                                      PID:1620
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        27⤵
                                                                                          PID:2556
                                                                                        • C:\Windows\es-ES\Idle.exe
                                                                                          "C:\Windows\es-ES\Idle.exe"
                                                                                          27⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1616
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat"
                                                                                            28⤵
                                                                                              PID:4736
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                29⤵
                                                                                                  PID:516
                                                                                                • C:\Windows\es-ES\Idle.exe
                                                                                                  "C:\Windows\es-ES\Idle.exe"
                                                                                                  29⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3192
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat"
                                                                                                    30⤵
                                                                                                      PID:4448
                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                        31⤵
                                                                                                          PID:2708
                                                                                                        • C:\Windows\es-ES\Idle.exe
                                                                                                          "C:\Windows\es-ES\Idle.exe"
                                                                                                          31⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4004
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
                                                                                                            32⤵
                                                                                                              PID:1692
                                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                33⤵
                                                                                                                  PID:2268
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2520
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2764
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1144
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5068
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5004
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:764
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3464
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4212
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:676
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3964
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:744
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2960
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1052
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3272
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:220
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5056
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3188
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1552
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsass.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3172
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4636
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3144
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\lsass.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1336
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3600
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4332
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1472
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4388
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3904
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\ModemLogs\smss.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2216
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2820
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:592
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:656
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4652
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3740
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\Idle.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1440
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\es-ES\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1164
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2168

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  baf55b95da4a601229647f25dad12878

                                                  SHA1

                                                  abc16954ebfd213733c4493fc1910164d825cac8

                                                  SHA256

                                                  ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                  SHA512

                                                  24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  a43e653ffb5ab07940f4bdd9cc8fade4

                                                  SHA1

                                                  af43d04e3427f111b22dc891c5c7ee8a10ac4123

                                                  SHA256

                                                  c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

                                                  SHA512

                                                  62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  d28a889fd956d5cb3accfbaf1143eb6f

                                                  SHA1

                                                  157ba54b365341f8ff06707d996b3635da8446f7

                                                  SHA256

                                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                  SHA512

                                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  59d97011e091004eaffb9816aa0b9abd

                                                  SHA1

                                                  1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                  SHA256

                                                  18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                  SHA512

                                                  d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  cadef9abd087803c630df65264a6c81c

                                                  SHA1

                                                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                  SHA256

                                                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                  SHA512

                                                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  e8ce785f8ccc6d202d56fefc59764945

                                                  SHA1

                                                  ca032c62ddc5e0f26d84eff9895eb87f14e15960

                                                  SHA256

                                                  d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                                                  SHA512

                                                  66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  5f0ddc7f3691c81ee14d17b419ba220d

                                                  SHA1

                                                  f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                  SHA256

                                                  a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                  SHA512

                                                  2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                                • C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  08d5d22bb83f6fe6ce175ee7a96382dc

                                                  SHA1

                                                  6abce6de26f2204fc86d1a8058268bed900cc93a

                                                  SHA256

                                                  13d8c770acc183e8b5e2323d2e93d9389c55fbcd7e965432b66afd3a917b7a09

                                                  SHA512

                                                  ea5595f4ca64fc58c81322b0a57a2d99743562e310612eccaddbc702f0ce8460754e353c9f5950bbbd073b49ed886aca81a70608b131b73ac32d9483806331b8

                                                • C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  364952addb27a9f2fca0932d782d4d17

                                                  SHA1

                                                  4fac71f364d755ba9ed5e3fbfc386c701a44394e

                                                  SHA256

                                                  c0e817fbac299a38facd908af3a884222422066bfc732defdf1e1740b205339b

                                                  SHA512

                                                  538e26ba422860dab6b298080b8291588f84eca83d52d01ceae5afd3f59bb4ad5490f2fb9b5a26dc500a8d0ada8ba511899eb273f1849cb7e49e6c3f5ca42682

                                                • C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  80018103f7a2e6eb7547da608f9ea950

                                                  SHA1

                                                  11582e5b12a3351cfe7975173b67c993aaa1250e

                                                  SHA256

                                                  4d21e9702c0d426086f81928d65506213c0841eb787cb39636f05887bf3ab08a

                                                  SHA512

                                                  3a25a110f7d0190c6be25a5abdaa82c26f8219b17f57e1dc2620046c184a39a39e7283665b2ba420a8e72c3a0e2d250d5682fc29185ff939b18ab3bcefc1fc4d

                                                • C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  45d5ebc1f83660d186c4d15c2ab9909f

                                                  SHA1

                                                  530caede81d7594b4981332c2353efcc831e1422

                                                  SHA256

                                                  3542aa4ef25ef532226e0f4e16dae70e1868fdd323b97aedd2d6d93b0dcea6ea

                                                  SHA512

                                                  202a4ec33be48bf64386c691e072f435c8f7ea89c5a86c8c484ac513f6e701a1060ce96bc3c89eb60007a6c4c427ceb87dca39d5594d969769ca257f5aec2936

                                                • C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  b5dfcd541e5aa5eac786454111196cf0

                                                  SHA1

                                                  1fe90e32569b03b59c5cf0a4ce7bb9d6c6a5016d

                                                  SHA256

                                                  e91cf55c55357f346cc89b1f906c8eabb52a6f1c2f315bd8619b28537ff1119e

                                                  SHA512

                                                  d8b4828405bd858390826ce58d61f1ef82c43e8e92e156d2177daad1e1a6e23b28f8a15a0720f7688a826f6e06954214ab90a5706817e7ee8f775bab3ddc78bd

                                                • C:\Users\Admin\AppData\Local\Temp\OrAhl4fNEA.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  1927ed9f206cb0e3db444a7b7175c955

                                                  SHA1

                                                  791dfa7595d38f864c1c96c764e0f99be0cbbe13

                                                  SHA256

                                                  603a1566aa358b2995c03e70fec2f1a20f7d21bd02f7de2182d458dd98d73a21

                                                  SHA512

                                                  08e4578eed19994d41bd382efb4e0c4c8859a0be482f294363375e64c8f45edf4c1154150df0346f911568305f5234d25bd50f374297415a0796f14a93373ec5

                                                • C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  5007b3cbc33cf063ac06e076a0abef84

                                                  SHA1

                                                  88d1629b3e04d88e93eb357bcd1f5ad6c56d422e

                                                  SHA256

                                                  55f22dd05c8531aefdf50925e15c592959e05e730105bdc7209e725cf12488b8

                                                  SHA512

                                                  16263c500c386786798ca973035467ff6df4ccabf51335736f93874c856ff5896137d65f9e7d7cee6ba3bae8ab6e5cd06b9a89da01d218d10525bc5221829edb

                                                • C:\Users\Admin\AppData\Local\Temp\Zlmto9DLwM.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  ec4b122b361affbfa4fa5b1d138e5932

                                                  SHA1

                                                  ac3dd3411452594dadc5837f5d2483baace30093

                                                  SHA256

                                                  d380f84300da53d38453ff84289734c07b4c4f19ca851ecb2b73dbf222856b84

                                                  SHA512

                                                  d078db4ac1e74563ba61188f0b9dbf63480dbc72af5cc8cb00b87077657da049a180dc8811c57b3c0352880818975dc553062f3b10ca6100204a102cc91ec23a

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_05dyjn0i.xhb.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  7ed98ce7445491a57316428b5b665764

                                                  SHA1

                                                  35def1f980add7077487b4d5b222305c954d4381

                                                  SHA256

                                                  8a6a0cf86eefea70fe960643854d2239adfecb4d08b9e8a420bde6bd7609e969

                                                  SHA512

                                                  6c0c4baee06eec21397a3a48930c8518499071c1ee7c84be0679e93d7c17032bcf0f1e8b8d48bf15b48c7495658080218605a6ef476c4b1dd32f18ca64672ffb

                                                • C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  24b227dd21ecfec0bd92aac0f88aed83

                                                  SHA1

                                                  bfa8da720d9a10ea672bdfffed1105db5a0bb123

                                                  SHA256

                                                  c24d7b1d644798634402c8ac6b9d114c95332ab067723811be2160498c9110f9

                                                  SHA512

                                                  4ab8fcc7e10d04ab3248f919ab94508faf62f907906c382c2531d30627fb581f5ad4959c2162a2df88251feec52c49eb2afbb3cd670f06acad4ce62094aaf61f

                                                • C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  f2514f1d3c4885bda43fe304a09db31d

                                                  SHA1

                                                  b945a0c4e9f8af87351a34b04a1a0ed054bf5a59

                                                  SHA256

                                                  ad1d26fc05fecbd8cba0b3de213675bc1ca8570e17e9632ce8116644ee163e7f

                                                  SHA512

                                                  25ce5ede6ad36a3775a4bea60ca075b968036cff29981cf8f0ddb9c6f0e3e73949a22fbb511b4707b2fe86fc15a3e2ec1610d25ed8c3a4ee7487f9f9e4991082

                                                • C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  030d2275540ee16f86946816ecd853e0

                                                  SHA1

                                                  383db5d98639bfc538495686d7cf381555726516

                                                  SHA256

                                                  09b7affc948e51fffda42ac5ba2c2ef347e4b305b5b871966222370e39de2e8a

                                                  SHA512

                                                  d29133352605963be3ec31866e3d40761d2f29cb46dede6dd2cc244edcf350688225449545a0362c710273717a5b03d3264b6950d97799ad1a44b13d294be28b

                                                • C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat

                                                  Filesize

                                                  190B

                                                  MD5

                                                  3932668043771dcf322a966e78c4ef48

                                                  SHA1

                                                  72e310ad87b6efd225031c1442039bd76f2bdd58

                                                  SHA256

                                                  5d70d09c802f4f61d8613ef0e3e7ec18ca6dafb6210ce71418072e2bf7708848

                                                  SHA512

                                                  75a9531ba12912dfdf6a4ebacac9cca2e6f89baeac929b208cd3735fb7cf22b93d6e386cbe3e9d62ed88e1c39080e68e3ac36d907b50d085f1eedc0602096ae3

                                                • C:\providercommon\1zu9dW.bat

                                                  Filesize

                                                  36B

                                                  MD5

                                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                                  SHA1

                                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                  SHA256

                                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                  SHA512

                                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                • C:\providercommon\DllCommonsvc.exe

                                                  Filesize

                                                  1.0MB

                                                  MD5

                                                  bd31e94b4143c4ce49c17d3af46bcad0

                                                  SHA1

                                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                  SHA256

                                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                  SHA512

                                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                  Filesize

                                                  197B

                                                  MD5

                                                  8088241160261560a02c84025d107592

                                                  SHA1

                                                  083121f7027557570994c9fc211df61730455bb5

                                                  SHA256

                                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                  SHA512

                                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                • memory/732-14-0x00000000014C0000-0x00000000014D2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/732-13-0x0000000000AF0000-0x0000000000C00000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/732-12-0x00007FFB380B3000-0x00007FFB380B5000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/732-15-0x00000000014D0000-0x00000000014DC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/732-16-0x0000000002D30000-0x0000000002D3C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/732-17-0x0000000002D40000-0x0000000002D4C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/1500-207-0x0000000002A90000-0x0000000002AA2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/1616-271-0x00000000015E0000-0x00000000015F2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/1616-276-0x000000001C730000-0x000000001C8D9000-memory.dmp

                                                  Filesize

                                                  1.7MB

                                                • memory/2304-264-0x0000000002710000-0x0000000002722000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/3192-284-0x000000001BFE0000-0x000000001C189000-memory.dmp

                                                  Filesize

                                                  1.7MB

                                                • memory/3580-203-0x000000001C8F0000-0x000000001CA5A000-memory.dmp

                                                  Filesize

                                                  1.4MB

                                                • memory/3768-250-0x0000000002AB0000-0x0000000002AC2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/4004-291-0x000000001C670000-0x000000001C819000-memory.dmp

                                                  Filesize

                                                  1.7MB

                                                • memory/4776-257-0x0000000002B20000-0x0000000002B32000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/4908-58-0x0000027A62B40000-0x0000027A62B62000-memory.dmp

                                                  Filesize

                                                  136KB