Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 14:02

General

  • Target

    ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe

  • Size

    1.3MB

  • MD5

    5ec903e23e0761c4a80461c4e432924c

  • SHA1

    9d0b43901d9bfbe2012a2a48d00f75f6c736591d

  • SHA256

    ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1

  • SHA512

    fcc167508708b7c472b420b3091f6c99d0f1719280379e35a342bf32eeeae98dd8eebcb9e5417501d4c8aef12cc673cd948647ae0a916aa671536f51978e816d

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 10 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe
    "C:\Users\Admin\AppData\Local\Temp\ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:616
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4272
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1404
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'
            5⤵
              PID:3392
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:216
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4900
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
              5⤵
                PID:2920
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3252
              • C:\providercommon\DllCommonsvc.exe
                "C:\providercommon\DllCommonsvc.exe"
                5⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2488
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4748
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'
                  6⤵
                    PID:4676
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3788
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\rdyboost\SppExtComObj.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2768
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2736
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4148
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:316
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5024
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4892
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'
                    6⤵
                      PID:1724
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1304
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5048
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\McA6atQ601.bat"
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2396
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        7⤵
                          PID:3472
                        • C:\providercommon\DllCommonsvc.exe
                          "C:\providercommon\DllCommonsvc.exe"
                          7⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Drops file in Program Files directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:372
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2816
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WaaSMedicAgent.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4392
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\explorer.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4088
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4788
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WaaSMedicAgent.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4128
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1548
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4708
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4688
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
                            8⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1724
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4752
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4848
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2076
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:456
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\spoolsv.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3140
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1464
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5108
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4260
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2784
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3656
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4952
                          • C:\odt\WaaSMedicAgent.exe
                            "C:\odt\WaaSMedicAgent.exe"
                            8⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1224
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
                              9⤵
                                PID:6012
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  10⤵
                                    PID:2848
                                  • C:\odt\WaaSMedicAgent.exe
                                    "C:\odt\WaaSMedicAgent.exe"
                                    10⤵
                                      PID:5308
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\Idle.exe'
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4744
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4524
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4072
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1860
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3408
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1076
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2628
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4576
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:380
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3084
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Idle.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:456
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4528
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:2496
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:3112
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:932
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4720
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4920
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1156
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2728
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\Idle.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1668
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4908
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:1548
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\odt\Idle.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:660
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2816
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:2884
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\INF\rdyboost\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1772
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\rdyboost\SppExtComObj.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1576
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:3184
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\rdyboost\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:384
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:2256
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4416
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4584
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4600
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2148
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3056
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:3156
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4952
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4120
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1588
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2356
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4080
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:2992
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4064
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3040
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:3420
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4140
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1608
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4664
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:824
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4132
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4440
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1652
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\odt\explorer.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2164
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4996
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4956
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2744
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2148
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2172
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:5012
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\providercommon\SppExtComObj.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1288
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4960
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:4576
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2572
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:380
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    PID:5064
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
                    1⤵
                      PID:1120
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
                      1⤵
                      • Creates scheduled task(s)
                      PID:2500
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
                      1⤵
                      • Creates scheduled task(s)
                      PID:552
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
                      1⤵
                      • Creates scheduled task(s)
                      PID:4276
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
                      1⤵
                      • Creates scheduled task(s)
                      PID:992
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                      1⤵
                        PID:4432
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                        1⤵
                        • Creates scheduled task(s)
                        PID:824
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                        1⤵
                          PID:3296
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /f
                          1⤵
                            PID:1500
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
                            1⤵
                            • Creates scheduled task(s)
                            PID:1188
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
                            1⤵
                              PID:1076
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                              1⤵
                                PID:1716
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                                1⤵
                                • Creates scheduled task(s)
                                PID:1224
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                1⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4676
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                1⤵
                                • Creates scheduled task(s)
                                PID:3420
                              • C:\Windows\system32\schtasks.exe
                                schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
                                1⤵
                                  PID:3476
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Creates scheduled task(s)
                                  PID:4720
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Creates scheduled task(s)
                                  PID:2200
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
                                  1⤵
                                  • Creates scheduled task(s)
                                  PID:624
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Creates scheduled task(s)
                                  PID:1940
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Cookies\spoolsv.exe'" /f
                                  1⤵
                                  • Creates scheduled task(s)
                                  PID:3260
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                    PID:2728
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Cookies\spoolsv.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Creates scheduled task(s)
                                    PID:3780
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\providercommon\wininit.exe'" /f
                                    1⤵
                                    • Creates scheduled task(s)
                                    PID:1752
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Creates scheduled task(s)
                                    PID:2132
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
                                    1⤵
                                      PID:2712
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /f
                                      1⤵
                                        PID:3464
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                          PID:5036
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Creates scheduled task(s)
                                          PID:4372
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                          1⤵
                                            PID:3812
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /f
                                            1⤵
                                              PID:1064
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\providercommon\csrss.exe'" /f
                                              1⤵
                                              • Creates scheduled task(s)
                                              PID:3596
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                              1⤵
                                                PID:2968
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                  PID:904
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Creates scheduled task(s)
                                                  PID:648
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Creates scheduled task(s)
                                                  PID:620
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
                                                  1⤵
                                                  • Creates scheduled task(s)
                                                  PID:2356
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Creates scheduled task(s)
                                                  PID:2020
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
                                                  1⤵
                                                  • Creates scheduled task(s)
                                                  PID:4588
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                    PID:3520
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
                                                    1⤵
                                                      PID:2752
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /f
                                                      1⤵
                                                        PID:3424
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Creates scheduled task(s)
                                                        PID:2340
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
                                                        1⤵
                                                          PID:4004
                                                        • C:\Windows\system32\dwm.exe
                                                          "dwm.exe"
                                                          1⤵
                                                            PID:1400

                                                          Network

                                                          MITRE ATT&CK Enterprise v6

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Recovery\WindowsRE\9e8d7a4ca61bd9

                                                            Filesize

                                                            543B

                                                            MD5

                                                            a8db95e867b2cfe233d80bceb4cfddfc

                                                            SHA1

                                                            c37089412c060498cb19f294cbab04d987ab1e63

                                                            SHA256

                                                            fd3a68db62ce216a55d9cfb609d3192ef4ff21b40852b2cea18a19dc16726384

                                                            SHA512

                                                            05f3bbe7fd622bb59194e479a8632b436dad69ecdade95768ae0af5884d2f4fe314caa630d7eac26851d24c994e8e512df530580157a603c11bdd77a2d91dab9

                                                          • C:\Recovery\WindowsRE\RuntimeBroker.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            7f3c0ae41f0d9ae10a8985a2c327b8fb

                                                            SHA1

                                                            d58622bf6b5071beacf3b35bb505bde2000983e3

                                                            SHA256

                                                            519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                                            SHA512

                                                            8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WaaSMedicAgent.exe.log

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            baf55b95da4a601229647f25dad12878

                                                            SHA1

                                                            abc16954ebfd213733c4493fc1910164d825cac8

                                                            SHA256

                                                            ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                            SHA512

                                                            24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                            SHA1

                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                            SHA256

                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                            SHA512

                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            77d622bb1a5b250869a3238b9bc1402b

                                                            SHA1

                                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                                            SHA256

                                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                            SHA512

                                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            77d622bb1a5b250869a3238b9bc1402b

                                                            SHA1

                                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                                            SHA256

                                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                            SHA512

                                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            62623d22bd9e037191765d5083ce16a3

                                                            SHA1

                                                            4a07da6872672f715a4780513d95ed8ddeefd259

                                                            SHA256

                                                            95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                            SHA512

                                                            9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                                            SHA1

                                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                            SHA256

                                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                            SHA512

                                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                                            SHA1

                                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                            SHA256

                                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                            SHA512

                                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                                            SHA1

                                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                            SHA256

                                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                            SHA512

                                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            a9a7f35c006bbf5da72f9cb250ffbddb

                                                            SHA1

                                                            458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

                                                            SHA256

                                                            a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

                                                            SHA512

                                                            d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            696d5d97c852cc09bebb341ec0fcfe5c

                                                            SHA1

                                                            5f00bd4b7d49c3ec7ba12828c01429998261d883

                                                            SHA256

                                                            9f990d714b61d03f69281aabd5cd2a3656ccea406c4ff03aa01d0c526e7cb2f1

                                                            SHA512

                                                            3cf44f32caa3454742d7d143ec405af40ce90fa4ba8dcd145050b0aa58a650bc79e45664002556edc811134f6a6e3255851a5c89908d884adc2f7551ba42ee80

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            908b291212a13f583afa11c1584e448a

                                                            SHA1

                                                            f1fd285463e2795753b5313e7a8aa9a166d33c99

                                                            SHA256

                                                            b3bfba1a75e4d6dd7edf3ad6e4e277d3f5f1027587a7390cd0dea3d0bd15abc9

                                                            SHA512

                                                            2c51e9c2ae2dd7777e8375704f68a8ba04b9f4dca7e1299a752a3f03a0cbd8cc112f0f71e1a7819bdb691c1f9897678714b0fa8b28afe0eac36b987679c22642

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            908b291212a13f583afa11c1584e448a

                                                            SHA1

                                                            f1fd285463e2795753b5313e7a8aa9a166d33c99

                                                            SHA256

                                                            b3bfba1a75e4d6dd7edf3ad6e4e277d3f5f1027587a7390cd0dea3d0bd15abc9

                                                            SHA512

                                                            2c51e9c2ae2dd7777e8375704f68a8ba04b9f4dca7e1299a752a3f03a0cbd8cc112f0f71e1a7819bdb691c1f9897678714b0fa8b28afe0eac36b987679c22642

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            a9451a6b9669d49bd90704dff21beb85

                                                            SHA1

                                                            5f93d2dec01a31e04fc90c28eb1c5ca62c6fff80

                                                            SHA256

                                                            b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056

                                                            SHA512

                                                            06634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            696d5d97c852cc09bebb341ec0fcfe5c

                                                            SHA1

                                                            5f00bd4b7d49c3ec7ba12828c01429998261d883

                                                            SHA256

                                                            9f990d714b61d03f69281aabd5cd2a3656ccea406c4ff03aa01d0c526e7cb2f1

                                                            SHA512

                                                            3cf44f32caa3454742d7d143ec405af40ce90fa4ba8dcd145050b0aa58a650bc79e45664002556edc811134f6a6e3255851a5c89908d884adc2f7551ba42ee80

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            96b72e19403cd41f7c6210390c41b5ee

                                                            SHA1

                                                            6e6f19576de7f7c59de0557e8f4517bf6ebcb182

                                                            SHA256

                                                            58ac8248e55b679a69dd21156b046f60eecb8100eefae5e0ddc18861f537cf3a

                                                            SHA512

                                                            6e989d1564eb35e3b23b23b8a667910eee083bb6c80562973fb2b020fe29a62de0fc8fac7a1efb0eacb28963279411df7660bf38a7c9b1c38787ef080012344e

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            c5f08d24862e6379a8d1690a00cec9d9

                                                            SHA1

                                                            bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

                                                            SHA256

                                                            5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

                                                            SHA512

                                                            1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            c5f08d24862e6379a8d1690a00cec9d9

                                                            SHA1

                                                            bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

                                                            SHA256

                                                            5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

                                                            SHA512

                                                            1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            c5f08d24862e6379a8d1690a00cec9d9

                                                            SHA1

                                                            bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

                                                            SHA256

                                                            5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

                                                            SHA512

                                                            1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            c5f08d24862e6379a8d1690a00cec9d9

                                                            SHA1

                                                            bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

                                                            SHA256

                                                            5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

                                                            SHA512

                                                            1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            3c625954a51c4bbd8141206b00f6fc0a

                                                            SHA1

                                                            4128cb2f9d2984844e303e2e330e448334e5c273

                                                            SHA256

                                                            952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

                                                            SHA512

                                                            3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            3c625954a51c4bbd8141206b00f6fc0a

                                                            SHA1

                                                            4128cb2f9d2984844e303e2e330e448334e5c273

                                                            SHA256

                                                            952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

                                                            SHA512

                                                            3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            2ea84433da3f7bfd22f7dd492c9df37c

                                                            SHA1

                                                            2239657d8b222edeab5fbf28d143ce4f7cc7a5e1

                                                            SHA256

                                                            057bd5d95b404a7bba33179f407a4b445287c6ffc802957cae38712b81f78c4a

                                                            SHA512

                                                            603e37a5295cec27d0320f48252ce67cb8c7a20a0105294231565e8ecd476e5532f42f9ac9bf16e7645c0bb8b05391bbb2d85dc31dee818a78fae3a4cf2f0a59

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            be8f4a8468c0e7c25dcd243722a26bfa

                                                            SHA1

                                                            81dfb32c219bb2574499327cb5e9eb8fc90225b2

                                                            SHA256

                                                            a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

                                                            SHA512

                                                            db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            be8f4a8468c0e7c25dcd243722a26bfa

                                                            SHA1

                                                            81dfb32c219bb2574499327cb5e9eb8fc90225b2

                                                            SHA256

                                                            a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

                                                            SHA512

                                                            db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            f9a476833215fc86490087fc3a89e9a4

                                                            SHA1

                                                            f71f5d1f7441565846144998c37abcfaac690265

                                                            SHA256

                                                            de04c8f1bc5dddeb4adbd00fd8bf9e07a17b4feda5b8a78f692b206aed843f62

                                                            SHA512

                                                            9981c59346314dc69e2a3c3bde3220f8f4500f95e637d3aa4908cfcd26966a4e78b1ad53854d8300d13929d4ba0386236887424e20faf9dffcba2e7ca30647ce

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            6ee3f480a4fddbfac140e657fdcca9df

                                                            SHA1

                                                            c5b98dc87b595fd57940f47aa5200501534c8510

                                                            SHA256

                                                            7d4445e68d90227fcbe0274a6a1c037d45700c2ff0c62882b3244db468d06a5b

                                                            SHA512

                                                            c31af904b76393d71cb3c3b88ddbcd18664601201947c581a15b59ccaa07aea0dd847853e1fe615e0a1a84570643f3fd0e24e8401fff9140e2a38766aa0ff4d2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            8925cc4f81eb78ed54752cb09f7b0934

                                                            SHA1

                                                            f62fd8dfb10d42f8d6dee003bdcbc470df1b89bc

                                                            SHA256

                                                            c9bce703083e444b00adbe14bebffa77421d4eeb0b596ebd01a9d8185875104d

                                                            SHA512

                                                            f3aad77bab1dd364527e940f2322b9137ae4cf877a4f5a1d6466b3fbab0cd4a2cc5a59f40cf1720abfe573b000c252112692f5e5bb0dbf860fcfadfbbf688374

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            aff4f242ab99c6908e610129ca62a5ec

                                                            SHA1

                                                            befe36b3eb1087ced81cd85b367fa191a0f0bd1e

                                                            SHA256

                                                            2ee219774df72da97c9bab704d6e340f7c5621d1ca5f2895c793a93c89084d33

                                                            SHA512

                                                            974a49325f0d5ea0706495925714c97b8aff241f1d3c84d5ca269f6ee99bea49f963fd6e9f2756965e85cdf82b167b7eda465eaff4f827801838a2d42e4a1e1a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            27b2c5bc810c36d27db00baafffc6664

                                                            SHA1

                                                            1a67af75c46228e63544497df54bbe394fd7e356

                                                            SHA256

                                                            b223eb75c7c63fec3945a7bd6f1c68e051c1608248c235aa182f1d6078f41153

                                                            SHA512

                                                            56d91daa6a31537bfd11fdb91636e4cd2d57d0607ea5bf72ba02affba86f15aaae3a96fc9405c5208e91b277e32c11249fe14d066e64eadd292fdc00225c2b61

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            d0537cb6bfa3af510c0f70e0c9b7fdc6

                                                            SHA1

                                                            fdf97e039b63bbd11eef355af471428b686981be

                                                            SHA256

                                                            4f1b0e3b52ece34e98ef839eecadf593efc563542911e75092651e8b54fb69cc

                                                            SHA512

                                                            870523f6d89163e01ca9fd7e6426d941b2fb066ec0e877fb8a53ff97a72c9fddf7d76b41b06e0478b33bb9455d19a0e7d97507874510df588f677de5ceaa6c98

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            d0537cb6bfa3af510c0f70e0c9b7fdc6

                                                            SHA1

                                                            fdf97e039b63bbd11eef355af471428b686981be

                                                            SHA256

                                                            4f1b0e3b52ece34e98ef839eecadf593efc563542911e75092651e8b54fb69cc

                                                            SHA512

                                                            870523f6d89163e01ca9fd7e6426d941b2fb066ec0e877fb8a53ff97a72c9fddf7d76b41b06e0478b33bb9455d19a0e7d97507874510df588f677de5ceaa6c98

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            ee02cdcb025f6203e04573a984c71fbe

                                                            SHA1

                                                            1774451134cd51ae4523770e0477986c5a9efc2e

                                                            SHA256

                                                            bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

                                                            SHA512

                                                            64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            ee02cdcb025f6203e04573a984c71fbe

                                                            SHA1

                                                            1774451134cd51ae4523770e0477986c5a9efc2e

                                                            SHA256

                                                            bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

                                                            SHA512

                                                            64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            ee02cdcb025f6203e04573a984c71fbe

                                                            SHA1

                                                            1774451134cd51ae4523770e0477986c5a9efc2e

                                                            SHA256

                                                            bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

                                                            SHA512

                                                            64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            ee02cdcb025f6203e04573a984c71fbe

                                                            SHA1

                                                            1774451134cd51ae4523770e0477986c5a9efc2e

                                                            SHA256

                                                            bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

                                                            SHA512

                                                            64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            4005826b3da3d8f757d23831ac54fccf

                                                            SHA1

                                                            c6d46a83683b6f578e8f5c1b068b8ea1d10ff07e

                                                            SHA256

                                                            a91b6046ec90a9f56a3e9c633557752c8a6987d13e2b48639a5df1c7d9598865

                                                            SHA512

                                                            056b6af50e597f9ebd68c90740bbca863a0619cae551f0374034f044dc6e89508478b6d7e4c6a6be75a747821437034da4a74f840a42f72b0c16c37d83786520

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            672254f1b479acbb7d898df1bd21ccb8

                                                            SHA1

                                                            0eaf1dd3ecc670347acdec55bf076a8b9d7c5493

                                                            SHA256

                                                            f1814857fc838897086d194a651d77eecb3eba626256048e09c195fc37679026

                                                            SHA512

                                                            8b5a0c88ae80589376a4514ed25afc2a7c98e486ee651838f893edaa1a2ab1fae5f9cb21b75e721c7a66e4f6cb2b3f5d57923d113eb43a0140b04c3306d240c6

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            428e9f32b0adf022f74130298e739b8c

                                                            SHA1

                                                            5155c8377a8841c1f379e9b1dfc2602838420aaf

                                                            SHA256

                                                            6040e0ce0455ddc58119da76ef2daad9e56b57f8872b9f3e4c28a394173c4510

                                                            SHA512

                                                            bc87e2db789a7407c9bf4d6118934e73616fc17c4bbdc91fcb747488628731df660f5442e60e369ac810739a04fe07107d6c36d961b470904144def28866ad97

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            428e9f32b0adf022f74130298e739b8c

                                                            SHA1

                                                            5155c8377a8841c1f379e9b1dfc2602838420aaf

                                                            SHA256

                                                            6040e0ce0455ddc58119da76ef2daad9e56b57f8872b9f3e4c28a394173c4510

                                                            SHA512

                                                            bc87e2db789a7407c9bf4d6118934e73616fc17c4bbdc91fcb747488628731df660f5442e60e369ac810739a04fe07107d6c36d961b470904144def28866ad97

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            428e9f32b0adf022f74130298e739b8c

                                                            SHA1

                                                            5155c8377a8841c1f379e9b1dfc2602838420aaf

                                                            SHA256

                                                            6040e0ce0455ddc58119da76ef2daad9e56b57f8872b9f3e4c28a394173c4510

                                                            SHA512

                                                            bc87e2db789a7407c9bf4d6118934e73616fc17c4bbdc91fcb747488628731df660f5442e60e369ac810739a04fe07107d6c36d961b470904144def28866ad97

                                                          • C:\Users\Admin\AppData\Local\Temp\McA6atQ601.bat

                                                            Filesize

                                                            199B

                                                            MD5

                                                            e1427fe28c7ed04b98a7fc3127dc3fff

                                                            SHA1

                                                            169a376ae5f8bb79757afe478b10be27a6b72f78

                                                            SHA256

                                                            91ef273f80fdccef05732e8860336ac2ae9c7e2492e9cedb4de8d0f59158dcb9

                                                            SHA512

                                                            c41a93398f1cd7ea54307dbb9dd789899657026504b5ebeff5aeec006aab59e159fc410829a67531b4a5d1a3eea3e4930979e5924adce6044cc5d67319ac9b3e

                                                          • C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

                                                            Filesize

                                                            190B

                                                            MD5

                                                            80eaf2ef8f3e87340a83107ee8914dee

                                                            SHA1

                                                            06c2b24a9ccb6950f2bde111cf36cb8eaa65f12e

                                                            SHA256

                                                            911579abe2381dafc92896f84ab6c9c87524bec1de3da1372cf36d535acbda52

                                                            SHA512

                                                            7968bf85c88c0ec4bc397eaf11db109a1c2c8539ebdd8bd24fc80765d88dc1df8ae1c2a88355bbc1a97ce404ef36aa17a4226f2cd8718b958c8a8e00a427d608

                                                          • C:\odt\WaaSMedicAgent.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\odt\WaaSMedicAgent.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\odt\WaaSMedicAgent.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\1zu9dW.bat

                                                            Filesize

                                                            36B

                                                            MD5

                                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                                            SHA1

                                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                            SHA256

                                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                            SHA512

                                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                          • C:\providercommon\9e8d7a4ca61bd9

                                                            Filesize

                                                            575B

                                                            MD5

                                                            cfb6ca55bfbe44e9a32c1f6c98ee3602

                                                            SHA1

                                                            01fa991f5cef7948a6b11adea7f3c699cf5d31fc

                                                            SHA256

                                                            428441724e6ebd7cd5a1e930d55159beb75902057833c1a4b3a005023b015577

                                                            SHA512

                                                            bc298c7950a3977091bd497d49e73b5ac93f679f7e6880b0b6ad9d440e416dd1cd277fc7ddc56491b15979dd21b09b1faef1efc4f3d0425cb770d20445c03a5f

                                                          • C:\providercommon\DllCommonsvc.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\DllCommonsvc.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\DllCommonsvc.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\DllCommonsvc.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\RuntimeBroker.exe

                                                            Filesize

                                                            1.0MB

                                                            MD5

                                                            bd31e94b4143c4ce49c17d3af46bcad0

                                                            SHA1

                                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                            SHA256

                                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                            SHA512

                                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                            Filesize

                                                            197B

                                                            MD5

                                                            8088241160261560a02c84025d107592

                                                            SHA1

                                                            083121f7027557570994c9fc211df61730455bb5

                                                            SHA256

                                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                            SHA512

                                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                          • memory/216-160-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/216-152-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/316-197-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/316-223-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/372-229-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/372-264-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/456-271-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1304-193-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1304-213-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1404-169-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1404-157-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1464-268-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1548-263-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1724-222-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1724-199-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/1724-265-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2076-275-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2488-187-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2488-156-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2736-194-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2736-202-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2768-216-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2768-192-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2816-254-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2920-162-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2920-154-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3140-270-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3252-168-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3252-155-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3392-151-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3392-149-0x000001C885720000-0x000001C885742000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/3392-163-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3788-214-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/3788-190-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4088-256-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4128-266-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4148-196-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4148-218-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4260-272-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4280-139-0x0000000000E80000-0x0000000000F90000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/4280-150-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4280-140-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4392-257-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4676-188-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4676-204-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4688-267-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4708-262-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4744-210-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4744-189-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4748-209-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4748-186-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4752-269-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4788-259-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4848-274-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4892-226-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4892-200-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4900-153-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4900-165-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/4952-273-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/5024-198-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/5024-224-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/5048-191-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/5048-211-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/5108-277-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

                                                            Filesize

                                                            10.8MB