Overview

overview

10

Static

static

3

downloader.exe

windows7-x64

1

downloader.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 00:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    downloader.exe

  • Size

    30.1MB

  • MD5

    f492b89f4f36a71d994c7ce83f558579

  • SHA1

    c8cdf059e7568e4430cebc265dba1d63938c2814

  • SHA256

    a6a9fafb69e4b1e6c029d3662b1b2f4df6602971adf7b117829ad14eecfc88dc

  • SHA512

    8b3dd729a99de147908e3091d736607f19d29bf1da2a1dd304db8bb561e5c2fd8df277737f52e61e238acc5a9c12de3626c459e5a8f3ad87161cc0bfa784b618

  • SSDEEP

    393216:R8oimu7izBxR3QRzhzvQ99Sq8lu0q5tDJKoWSxJGBL7aQmo+AJCcLKAs:R9w9wD5xUeQbJCc0

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

83.38.24.1:1603

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 10 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 34 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 10 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Runs regedit.exe 31 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\downloader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Users\Admin\AppData\Local\Temp\notepad.exe
        "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2660
        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2168
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5056
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:924
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\OneDrive.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5768
        • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
          "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2848
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchFilterHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5668
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\SearchFilterHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2692
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SearchFilterHost" /tr "C:\Users\Admin\SearchFilterHost.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3564
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6096
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SecurityHealthSystray.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5484
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\ProgramData\SecurityHealthSystray.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:724
        • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
          "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:1612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3536
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5220
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5232
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WmiPrvSE" /tr "C:\ProgramData\WmiPrvSE.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:6108
        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Runs regedit.exe
          • Suspicious use of AdjustPrivilegeToken
          PID:4496
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\regedit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'regedit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\regedit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2864
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "regedit" /tr "C:\Users\Public\regedit.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5548
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3520
      • C:\Users\Admin\AppData\Local\Temp\notepad.exe
        "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1776
        • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
          "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3988
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1516
        • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
          "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1984
        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
          4⤵
          • Executes dropped EXE
          • Runs regedit.exe
          • Suspicious use of AdjustPrivilegeToken
          PID:4160
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\AppData\Local\Temp\notepad.exe
        "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3748
        • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
          "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4488
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1456
        • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
          "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2352
        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
          4⤵
          • Executes dropped EXE
          • Runs regedit.exe
          • Suspicious use of AdjustPrivilegeToken
          PID:1212
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Users\Admin\AppData\Local\Temp\notepad.exe
        "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5052
        • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
          "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3672
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1156
        • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
          "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
          4⤵
          • Executes dropped EXE
          • Runs regedit.exe
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
      2⤵
        PID:4304
        • C:\Users\Admin\AppData\Local\Temp\notepad.exe
          "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3588
          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4260
          • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
            "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:876
          • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
            "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5268
          • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
            "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5280
          • C:\Users\Admin\AppData\Local\Temp\regedit.exe
            "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
            4⤵
            • Executes dropped EXE
            • Runs regedit.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:5384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
        2⤵
          PID:5644
          • C:\Users\Admin\AppData\Local\Temp\notepad.exe
            "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:5692
            • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
              "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5892
            • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
              "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5924
            • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
              "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5964
            • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
              "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5996
            • C:\Users\Admin\AppData\Local\Temp\regedit.exe
              "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
              4⤵
              • Executes dropped EXE
              • Runs regedit.exe
              • Suspicious use of AdjustPrivilegeToken
              PID:6012
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
          2⤵
            PID:5616
            • C:\Users\Admin\AppData\Local\Temp\notepad.exe
              "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:1020
              • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:6020
              • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5748
              • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:6004
              • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2928
              • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                4⤵
                • Executes dropped EXE
                • Runs regedit.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:3512
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
            2⤵
              PID:5076
              • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:5548
                • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1596
                • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                  "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1140
                • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                  "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6080
                • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                  "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5908
                • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                  "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                  4⤵
                  • Executes dropped EXE
                  • Runs regedit.exe
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4724
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
              2⤵
                PID:5352
                • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                  "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5348
                  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5640
                  • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                    "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4348
                  • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                    "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2124
                  • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                    "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1448
                  • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                    "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                    4⤵
                    • Executes dropped EXE
                    • Runs regedit.exe
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5656
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                2⤵
                  PID:2184
                  • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                    "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:3548
                    • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:1852
                    • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                      "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5600
                    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:2204
                    • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                      "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:5244
                    • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                      "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                      4⤵
                      • Executes dropped EXE
                      • Runs regedit.exe
                      PID:5276
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                  2⤵
                    PID:4556
                    • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                      "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:4316
                      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:5560
                      • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                        "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:1152
                      • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                        "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:2128
                      • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                        "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                        4⤵
                          PID:5344
                        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                          4⤵
                          • Runs regedit.exe
                          PID:4256
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                      2⤵
                        PID:3476
                        • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                          "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                          3⤵
                          • Checks computer location settings
                          PID:2044
                          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                            4⤵
                              PID:316
                            • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                              "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                              4⤵
                                PID:1224
                              • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                4⤵
                                  PID:2296
                                • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                  "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                  4⤵
                                    PID:5300
                                  • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                    "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                    4⤵
                                    • Runs regedit.exe
                                    PID:5280
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                2⤵
                                  PID:1064
                                  • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                    "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                    3⤵
                                    • Checks computer location settings
                                    PID:4584
                                    • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                      4⤵
                                        PID:5956
                                      • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                        "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                        4⤵
                                          PID:5944
                                        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                          4⤵
                                            PID:5248
                                          • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                            "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                            4⤵
                                              PID:5596
                                            • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                              "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                              4⤵
                                              • Runs regedit.exe
                                              PID:5924
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                          2⤵
                                            PID:6060
                                            • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                              "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                              3⤵
                                              • Checks computer location settings
                                              PID:972
                                              • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                4⤵
                                                  PID:5836
                                                • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                  4⤵
                                                    PID:5288
                                                  • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                    4⤵
                                                      PID:5824
                                                    • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                      4⤵
                                                        PID:3336
                                                      • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                        4⤵
                                                        • Runs regedit.exe
                                                        PID:2400
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                    2⤵
                                                      PID:1540
                                                      • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                        3⤵
                                                        • Checks computer location settings
                                                        PID:4532
                                                        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                          4⤵
                                                            PID:5536
                                                          • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                            4⤵
                                                              PID:3512
                                                            • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                              4⤵
                                                                PID:5684
                                                              • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                4⤵
                                                                  PID:5688
                                                                • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                  4⤵
                                                                  • Runs regedit.exe
                                                                  PID:3528
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                              2⤵
                                                                PID:5340
                                                                • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                  3⤵
                                                                  • Checks computer location settings
                                                                  PID:5664
                                                                  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                    4⤵
                                                                      PID:2264
                                                                    • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                      4⤵
                                                                        PID:5440
                                                                      • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                        4⤵
                                                                          PID:5908
                                                                        • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                          4⤵
                                                                            PID:4724
                                                                          • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                            4⤵
                                                                            • Runs regedit.exe
                                                                            PID:5920
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                        2⤵
                                                                          PID:5780
                                                                          • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                            3⤵
                                                                            • Checks computer location settings
                                                                            PID:5500
                                                                            • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                              4⤵
                                                                                PID:5816
                                                                              • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                4⤵
                                                                                  PID:5432
                                                                                • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                  4⤵
                                                                                    PID:5804
                                                                                  • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                    4⤵
                                                                                      PID:848
                                                                                    • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                      4⤵
                                                                                      • Runs regedit.exe
                                                                                      PID:3968
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                  2⤵
                                                                                    PID:5636
                                                                                    • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                      3⤵
                                                                                      • Checks computer location settings
                                                                                      PID:5592
                                                                                      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                        4⤵
                                                                                          PID:6004
                                                                                        • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                          4⤵
                                                                                            PID:2768
                                                                                          • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                            4⤵
                                                                                              PID:5236
                                                                                            • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                              4⤵
                                                                                                PID:5204
                                                                                              • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                4⤵
                                                                                                • Runs regedit.exe
                                                                                                PID:5840
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                            2⤵
                                                                                              PID:1644
                                                                                              • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                3⤵
                                                                                                • Checks computer location settings
                                                                                                PID:4848
                                                                                                • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                  4⤵
                                                                                                    PID:1520
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                    4⤵
                                                                                                      PID:5344
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                      4⤵
                                                                                                        PID:5240
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                        4⤵
                                                                                                          PID:5544
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                          4⤵
                                                                                                          • Runs regedit.exe
                                                                                                          PID:5664
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                      2⤵
                                                                                                        PID:5328
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                          3⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:3276
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                            4⤵
                                                                                                              PID:4884
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                              4⤵
                                                                                                                PID:5716
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                4⤵
                                                                                                                  PID:5720
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                  4⤵
                                                                                                                    PID:1712
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                    4⤵
                                                                                                                    • Runs regedit.exe
                                                                                                                    PID:5488
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                2⤵
                                                                                                                  PID:768
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                    3⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:5984
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                      4⤵
                                                                                                                        PID:5924
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                        4⤵
                                                                                                                          PID:5752
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                          4⤵
                                                                                                                            PID:5532
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                            4⤵
                                                                                                                              PID:5788
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                              4⤵
                                                                                                                              • Runs regedit.exe
                                                                                                                              PID:5580
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                          2⤵
                                                                                                                            PID:1456
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                              3⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:5884
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:5868
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:3584
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:3064
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:2724
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Runs regedit.exe
                                                                                                                                        PID:1624
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                    2⤵
                                                                                                                                      PID:1680
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:5584
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:5688
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:112
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:5320
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:4588
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Runs regedit.exe
                                                                                                                                                  PID:5812
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                              2⤵
                                                                                                                                                PID:1380
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  PID:2944
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:5568
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5912
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2308
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:5396
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                            4⤵
                                                                                                                                                            • Runs regedit.exe
                                                                                                                                                            PID:5476
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2192
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            PID:2212
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4048
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:4348
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:5864
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4424
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Runs regedit.exe
                                                                                                                                                                      PID:3516
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5140
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:4512
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:3416
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1292
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:5464
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5840
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Runs regedit.exe
                                                                                                                                                                                PID:6044
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1588
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                PID:4432
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:3784
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:5656
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:1020
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:5700
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Runs regedit.exe
                                                                                                                                                                                          PID:5908
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4884
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          PID:5776
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:5816
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:3460
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2960
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Runs regedit.exe
                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    PID:5748
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:2928
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5532
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Runs regedit.exe
                                                                                                                                                                                                              PID:5580
                                                                                                                                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                        PID:544
                                                                                                                                                                                                      • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                        C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                        • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                          C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1852
                                                                                                                                                                                                          • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                                            C:\Windows\System32\sihclient.exe /cv iMBYMemNpEezJFEGoeAeKw.0.2
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:112
                                                                                                                                                                                                            • C:\ProgramData\SecurityHealthSystray.exe
                                                                                                                                                                                                              C:\ProgramData\SecurityHealthSystray.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                              • C:\ProgramData\WmiPrvSE.exe
                                                                                                                                                                                                                C:\ProgramData\WmiPrvSE.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                • C:\Users\Admin\SearchFilterHost.exe
                                                                                                                                                                                                                  C:\Users\Admin\SearchFilterHost.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                  • C:\Users\Public\regedit.exe
                                                                                                                                                                                                                    C:\Users\Public\regedit.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Runs regedit.exe
                                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                                  • C:\Users\Admin\OneDrive.exe
                                                                                                                                                                                                                    C:\Users\Admin\OneDrive.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                    • C:\ProgramData\SecurityHealthSystray.exe
                                                                                                                                                                                                                      C:\ProgramData\SecurityHealthSystray.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5860
                                                                                                                                                                                                                      • C:\Users\Admin\SearchFilterHost.exe
                                                                                                                                                                                                                        C:\Users\Admin\SearchFilterHost.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                        • C:\Users\Public\regedit.exe
                                                                                                                                                                                                                          C:\Users\Public\regedit.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Runs regedit.exe
                                                                                                                                                                                                                          PID:3520
                                                                                                                                                                                                                        • C:\ProgramData\WmiPrvSE.exe
                                                                                                                                                                                                                          C:\ProgramData\WmiPrvSE.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5544
                                                                                                                                                                                                                          • C:\Users\Admin\OneDrive.exe
                                                                                                                                                                                                                            C:\Users\Admin\OneDrive.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4092

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\notepad.exe.log
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              654B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              6d42b6da621e8df5674e26b799c8e2aa

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              d28a889fd956d5cb3accfbaf1143eb6f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              157ba54b365341f8ff06707d996b3635da8446f7

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              62623d22bd9e037191765d5083ce16a3

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              4a07da6872672f715a4780513d95ed8ddeefd259

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              163KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              abd4141118794cd94979dc12bcded7b7

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27b11caedb23ea8dab4f36f5865a96e6e7f55806

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              be9f4292935c19f00dcf2a6e09bc63f50cf7caad0d8ea0a45ed7bf86fb14e904

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              d4ddda6b8ac66683e78b78360326ee50edf5edc8278a2f82e414545d4dd2a3d5e4269fe1dd884926b2e6d7e52af030f0b66fcca50cad77b8a31837ff482c4809

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              145KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              40324e8a46ec891bcb5300f51ddfc335

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              bc5c53d890371bd472c707da8e84c3925bf077d5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              cc7bcd68ad32d8490fd2d5217b5bace0068a7ebf96831f0373d88e27e6a3ff2c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5b2c618234a6b14ea377604f08dd3c6f193be4f593f18b38ff9a3b88f939d61934c3ec4efca91ff98791051eeb79a53315168bfa0fe8466b60249f3bde9b86de

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              243KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              f32ac010fcdbc8f8a5582c339ec9d9ea

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              20c06c5a174504c4e28c9aa0b51a62ab8f5c70cb

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              88835382ffaf3f7f0730a0a7edab3d3214cbbfdbc35e7269b80a6bd05b7edd18

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              9798b196315a1e463105b811a0937f763ae21826fa9bd9f346059b5f0a573d48a6f4ed7174fb4551a4ae7ccd089c9cae90c30b38ef6e7c12e896138a0fcaa8f4

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              16caf66537fe87d8d9b6a4eb34d9dbff

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              4a399f4229ea5b27963d467223fd4ceb89e545f5

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              64cc787990be5cdc1c25f5cdbfd2a0e93d4c68a888fefa0b7e2b0d12cea4de26

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a034dba721d36b5396dbe08a581d06c692c84edb0946e45073a8e3eb78a685ad42011b8ffa970190e673e94350dc1feef8d8f51908b53bc23a80536f75bba9d8

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sh3xlj24.ser.ps1
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\notepad.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              909KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              74b16801ca2365d3b29e6194237c665a

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              9d172c5a08c68e8134eaad60063071662afd5057

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              8201c89ce2e7eab9b5bfe3f8da956c73604261e83a3bf5d267be6a9b44790ec714e22a0ddfbc9fd009395893ef68864e5fac54172aceb568aec2270de6700567

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\regedit.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              121KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              005b549e8fa8f966d1c0ce845cfaffce

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              4dc69fa135bec170229863f4d7320b402698cef1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8befb7faacdffeb7dd84b629ec7066ed1baf3947a6ed8c1ac8432335e3b2828b

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1169ec7a0628a03ecb8a924527fa03dd0d391f9d0bf2a537e9ee7022265bfeba57b85759507fbc4962f10a5f43f2ea86d8c18cbf00aa8f5b9a2323174a9663ec

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • memory/544-90-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-89-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-83-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-82-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-94-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-93-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-92-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-91-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-88-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-84-0x000001B18B900000-0x000001B18B901000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1612-62-0x0000000000F50000-0x0000000000F74000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2168-43-0x0000000000A70000-0x0000000000AA0000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2660-6-0x0000000000250000-0x0000000000338000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              928KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2660-5-0x00007FFDD2693000-0x00007FFDD2695000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2848-113-0x000001BA6E750000-0x000001BA6E772000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/3728-50-0x0000000000310000-0x0000000000352000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              264KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4444-49-0x0000000000600000-0x000000000062A000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/4496-67-0x0000000000670000-0x0000000000694000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                              Download