Overview

overview

10

Static

static

3

ec455e7827...ff.exe

windows7-x64

10

ec455e7827...ff.exe

windows10-2004-x64

10

ec455e7827...ff.exe

android-9-x86

ec455e7827...ff.exe

android-10-x64

ec455e7827...ff.exe

android-11-x64

ec455e7827...ff.exe

macos-10.15-amd64

ec455e7827...ff.exe

ubuntu-18.04-amd64

ec455e7827...ff.exe

debian-9-armhf

ec455e7827...ff.exe

debian-9-mips

ec455e7827...ff.exe

debian-9-mipsel

Resubmissions

13-01-2025 06:01

250113-gqyq5syqex 10

12-01-2025 22:40

250112-2ll7rsvqek 10

Analysis

  • max time kernel
    900s
  • max time network
    898s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2025 06:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe

  • Size

    1.5MB

  • MD5

    207f37be38ccbb0fe77bda8d4ab69187

  • SHA1

    97a4aa79a700e336ca8450bfbf38d7e18215173b

  • SHA256

    ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff

  • SHA512

    34350185b31d087e3d9027bdaa382497c061d68fd9d30a201d2563598fdaf2ef05dc8f08f27bc13af0303fc5694f2fea997e1ef042168e705cc83c3f23f6c93e

  • SSDEEP

    24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpRK:kzhWhCXQFN+0IEuQgyiVKS

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 15 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 14 IoCs
    persistence
  • Process spawned unexpected child process 14 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 64 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 28 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 64 IoCs
    evasiontrojan
  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe
    C:\Users\Admin\AppData\Local\Temp\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\lsm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\lz32\lsm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\winload\winlogon.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\dwm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\bthprops\csrss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2360
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1060
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\lsass.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pz54l4hn7h.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1704
        • C:\Users\Admin\AppData\Local\Temp\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe
          "C:\Users\Admin\AppData\Local\Temp\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe"
          3⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:820
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\de-DE\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\spoolsv.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2604
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\services.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\PortableDeviceWiaCompat\wininit.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\audiodg.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3024
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2nBQS9KNh.bat"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1532
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              5⤵
                PID:2280
              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                5⤵
                • UAC bypass
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:1200
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14aac92b-1a3d-490e-abfa-d1470bd0e252.vbs"
                  6⤵
                    PID:3000
                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                      7⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2692
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e581f7a-a26d-4827-bf37-41f28aa734b6.vbs"
                        8⤵
                          PID:2664
                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                            9⤵
                            • UAC bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2928
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e8bb6fc-aaaf-4d41-b589-64e7dadb7b1c.vbs"
                              10⤵
                                PID:2200
                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                  11⤵
                                  • UAC bypass
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:2488
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c01cf770-fbc8-4c3c-b3fd-f670bb2aa132.vbs"
                                    12⤵
                                      PID:1564
                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                        13⤵
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1328
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79d9bb9e-5630-47d5-939a-81bdd3c6da06.vbs"
                                          14⤵
                                            PID:1532
                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                              15⤵
                                              • UAC bypass
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:2672
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f076f326-fc17-4cbe-ac48-d915160e5e49.vbs"
                                                16⤵
                                                  PID:2504
                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                    17⤵
                                                    • UAC bypass
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:2632
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31e796bf-3d83-4555-8da0-408ce95f7199.vbs"
                                                      18⤵
                                                        PID:568
                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                          19⤵
                                                          • UAC bypass
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1632
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dd67e95-d470-4149-b9bd-e90a8599c7bd.vbs"
                                                            20⤵
                                                              PID:1256
                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                21⤵
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:688
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46e73f8e-a85d-4f39-9a4e-a800329e3beb.vbs"
                                                                  22⤵
                                                                    PID:1700
                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                      23⤵
                                                                      • UAC bypass
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:1564
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62bb5bfc-90dc-4ce1-a8e2-c6dc6b9526f3.vbs"
                                                                        24⤵
                                                                          PID:2256
                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                            25⤵
                                                                            • UAC bypass
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:624
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eec580d3-44d2-4339-a9d7-e0a61d8a2114.vbs"
                                                                              26⤵
                                                                                PID:2212
                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                  27⤵
                                                                                  • UAC bypass
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • System policy modification
                                                                                  PID:1656
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9117b2b-6810-404d-ad7e-15f8a505ec09.vbs"
                                                                                    28⤵
                                                                                      PID:1108
                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                        29⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3016
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fddd899-d2f3-407d-badd-905b61b22d97.vbs"
                                                                                          30⤵
                                                                                            PID:1680
                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                              31⤵
                                                                                              • UAC bypass
                                                                                              • Executes dropped EXE
                                                                                              • Checks whether UAC is enabled
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3052
                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a346505-58f5-4429-b0ec-eb44368c6aab.vbs"
                                                                                                32⤵
                                                                                                  PID:2204
                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                    33⤵
                                                                                                    • UAC bypass
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • System policy modification
                                                                                                    PID:1564
                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\432bc2f3-6454-4dca-8551-a4ca636fb28a.vbs"
                                                                                                      34⤵
                                                                                                        PID:2832
                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                          35⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Checks whether UAC is enabled
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • System policy modification
                                                                                                          PID:3036
                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd3de68e-6bb0-428f-8464-879aaf6b25d3.vbs"
                                                                                                            36⤵
                                                                                                              PID:2780
                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                37⤵
                                                                                                                • UAC bypass
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • System policy modification
                                                                                                                PID:2212
                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fee0c42c-d171-4d17-84b4-e5462a2661bd.vbs"
                                                                                                                  38⤵
                                                                                                                    PID:308
                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                      39⤵
                                                                                                                      • UAC bypass
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks whether UAC is enabled
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2220
                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89805a98-6c12-4a69-8db7-7983ab96f65d.vbs"
                                                                                                                        40⤵
                                                                                                                          PID:1160
                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                            41⤵
                                                                                                                            • UAC bypass
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • System policy modification
                                                                                                                            PID:1484
                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3dbc889-7b28-4cd8-81a9-0532b07be37a.vbs"
                                                                                                                              42⤵
                                                                                                                                PID:1932
                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                  43⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • System policy modification
                                                                                                                                  PID:2504
                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6b641d4-fa3e-4b1e-ae4c-411df0e4cce2.vbs"
                                                                                                                                    44⤵
                                                                                                                                      PID:2832
                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                        45⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:2824
                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cee6b21c-47ee-47fa-a6e7-8c00c841e0cf.vbs"
                                                                                                                                          46⤵
                                                                                                                                            PID:1264
                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                              47⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              • System policy modification
                                                                                                                                              PID:1524
                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5234141-b553-4dc1-aa33-72d813a47bc3.vbs"
                                                                                                                                                48⤵
                                                                                                                                                  PID:688
                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                    49⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:932
                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63bd1024-0b27-4681-8255-a5a94e9b1a92.vbs"
                                                                                                                                                      50⤵
                                                                                                                                                        PID:2740
                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                          51⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:1300
                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fee43dbf-d03c-4683-bca2-a4de436fcf6d.vbs"
                                                                                                                                                            52⤵
                                                                                                                                                              PID:1856
                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                53⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:1488
                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9735fe81-ab78-4bd6-85e2-8a3989529f1d.vbs"
                                                                                                                                                                  54⤵
                                                                                                                                                                    PID:1404
                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                      55⤵
                                                                                                                                                                      • UAC bypass
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1144
                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e9013eb-2cce-4cb7-810c-dce5f71d598c.vbs"
                                                                                                                                                                        56⤵
                                                                                                                                                                          PID:1564
                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                            57⤵
                                                                                                                                                                            • UAC bypass
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:1788
                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1bc04a9-4ffc-45d2-9a9d-4838fe11613f.vbs"
                                                                                                                                                                              58⤵
                                                                                                                                                                                PID:624
                                                                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                  59⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:1280
                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e021129f-0511-4fe2-b98e-1a5bda91e78d.vbs"
                                                                                                                                                                                    60⤵
                                                                                                                                                                                      PID:2884
                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                        61⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:956
                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\999f9d9d-7930-44d0-a7d1-e6d5244c5fee.vbs"
                                                                                                                                                                                          62⤵
                                                                                                                                                                                            PID:1612
                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                              63⤵
                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                              PID:2848
                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61f33e59-a056-48ad-a855-8858bc000876.vbs"
                                                                                                                                                                                                64⤵
                                                                                                                                                                                                  PID:932
                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37407dac-650d-4943-9bb6-f5ff95d13a58.vbs"
                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:2468
                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f645760a-5718-486d-b4db-cd3d07561b86.vbs"
                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                              PID:1264
                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe8f03ba-da76-4492-b617-f2ffccce78fb.vbs"
                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ed5d80e-77fb-4c1c-9d56-894841b40e3b.vbs"
                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                          PID:2776
                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e19012a9-7652-423f-883a-f23553861872.vbs"
                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                                PID:2536
                                                                                                                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62bb405c-1fda-47a6-b330-9d8088fb0474.vbs"
                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\033926ac-d838-4812-8039-fd3fe2d2c07f.vbs"
                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                            PID:3056
                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:908
                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49047656-0279-4861-be8d-947802999ed1.vbs"
                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf416218-f9f3-461a-a7aa-a53a0ecaccd7.vbs"
                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                        PID:1964
                                                                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\665c5b70-c08f-4128-8f3b-00f01be8dd0e.vbs"
                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\774df207-493f-4833-a6b3-5e26ea90a592.vbs"
                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cac2a0da-258d-4f63-b9e6-debf25792870.vbs"
                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                          PID:2424
                                                                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:1496
                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa8cf5e9-ab56-4a69-9e0e-a7b7e0dcc074.vbs"
                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                PID:1948
                                                                                                                                                                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ec2ed92-fff6-4201-8df7-877b5cf4ab16.vbs"
                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:1288
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c8395ad-1cbe-4d20-bfc5-8fa105d31d21.vbs"
                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                            PID:1632
                                                                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                              PID:2108
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\528857b3-9262-4e17-a0d7-22214f515281.vbs"
                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                  PID:1436
                                                                                                                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                    PID:2180
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1e8a6b5-99ab-4e2a-bf57-e474ac935d9f.vbs"
                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26b48590-9db9-4ddd-8b13-3aa30c9256c2.vbs"
                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1903b9df-4ba4-4eae-bdc1-8cb110328c52.vbs"
                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b4fe274-239b-4ac3-ac55-2d0a5518b9a1.vbs"
                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                          PID:2108
                                                                                                                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\900921cb-13a7-4fb2-a814-ba871e2a8732.vbs"
                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                PID:3028
                                                                                                                                                                                                                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:784
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c26a7ee0-b990-496d-88fc-55a7ed9d2d6d.vbs"
                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                      PID:820
                                                                                                                                                                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\034f485e-9c56-4b0a-a76f-bc47973fc0cf.vbs"
                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a9768b0-2cab-434b-984c-35e6b863b67b.vbs"
                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\341f06a5-6ac7-4c03-bdbb-f81287acd23c.vbs"
                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2276
                                                                                                                                                                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a45264d7-eec8-4ce5-abab-4d44e25c8f25.vbs"
                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1368
                                                                                                                                                                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                PID:592
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1008b6f2-e1be-471e-bee8-9185f88d6311.vbs"
                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                      PID:2124
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df4ca946-8800-4677-bb29-0bdae11b535d.vbs"
                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e829c8e-7db6-494a-a3e1-38402ef7950d.vbs"
                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                                                                                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63ae2b35-3e4b-4e2b-942e-3a88f9e70856.vbs"
                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2900
                                                                                                                                                                                                                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                        PID:1488
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d7c16aa-8fc8-4c03-9194-c17f89fa6f5a.vbs"
                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1300
                                                                                                                                                                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70223e3c-2871-4577-a57c-0f684e03056f.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c66edd48-3123-4061-abaf-c12b2b11b878.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e427719-6d6e-46db-981e-94d24e77767e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ced6265e-4976-4a91-84ac-c49a1a1f9c2e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a633abc5-4ea7-4dd3-9455-4e265c09f95f.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0000139f-e42b-49ca-8bd9-4a8f76880c61.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\961bf867-5423-46b7-8d01-e82528c8c8ab.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94f42117-a7e7-47c7-9a40-a9eb31f4fbeb.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d6c8cda-13fd-4e47-83f3-8322a7e6f8c2.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e91f5fd3-1ad7-4f2f-9ef7-65b180bef5f3.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\273239aa-0547-44fb-834a-74c75b5cebb0.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb5b4942-0853-4eba-ada1-ef90a8e5bbde.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29b9e155-ea18-4a4a-a7f1-1e2af11aa55c.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f40266e5-9e96-4c1d-8889-06abcdf92d4b.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8d9e86b-93f6-46a3-9050-587321c81a26.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4717ce60-bdfb-4599-bbb0-998cb42ab329.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c77a1ea3-63a9-49f0-becf-627f610013e0.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bdb7c4a-ac63-4e03-b17f-e1b1fdb9cfbb.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc48691b-9426-4b55-aacf-52f842237cac.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f29f73f-8496-46cb-b0eb-00e62d758e27.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10511ca9-7b7c-493b-8ab7-7e46db8d9fb1.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb6888be-84fb-4846-9247-49e73b5f743b.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f628b290-7c05-478f-a4a0-cb2848c6c862.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae99fd5b-a868-46bd-b90d-59f6800c05ca.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e52ad085-1610-423d-b2be-68f2b8c8ade0.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9d17d5e-2e29-40ff-88a2-85a98452eeee.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da5d3df7-84a3-45c5-a1a6-4addcb376b2c.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d97e4ec2-55c3-467f-a633-55ac338d99d4.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9edeccf-5dd8-4d60-8b31-7560d5cc9c4d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\797ee885-14ec-483d-bef2-da5e9e6f3820.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc145ca6-00aa-42cc-b780-70095eab9c66.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d7339c4-6fec-4d8b-b0bc-1afd74dcc126.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15b1b83e-62bd-4183-8d25-a019875e9db3.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\857f1ab9-67c5-4d8f-94aa-8c1e21382305.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5f8b632-989d-4640-98be-b119823dc486.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95554b6e-c7a7-4f8c-9bc2-273e8a7780b7.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97468b4f-3711-4543-8ce9-e133791d6c5d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31c3b567-e772-42c6-9c43-9561d5a40d7d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7389d60-c79b-4a85-bb9a-2bba9a7b1f4e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cee32df1-6bee-4b2a-91e1-0111aa2aa1b4.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cfd42761-2a8a-4e0b-b212-dbce16194c81.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b51945b6-dcb8-448c-865d-9e6bde158c0a.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d99f76df-1463-43ef-b19b-e28da1478004.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86426dba-1aa5-4db4-90a7-799838900482.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eda31de2-ff4a-413f-9013-a2682aac2f75.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8d7433f-f6fb-48aa-b984-450889fd58af.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b372a4b3-726b-4adb-9ec6-e31865cefe48.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7077dda4-1aa9-478d-82ee-7ffc1a6cb2d9.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8aae672-33b2-41e7-80b4-dc747684370a.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7408a3ff-8752-4dc6-82c2-7f9c4046cb16.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\384999c4-bb0b-4a31-a959-868189370427.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f25bcb9c-f994-4efe-ab86-9501b0ba1dc5.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91da15ee-3b04-4a93-a1da-e900abe7bf5d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f364ff0-4057-48c9-86e3-a089b1aaea56.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\447996a7-17b3-42e2-ab48-c38e7b75b0a1.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc39b15b-b319-4a76-abe2-1c6eecd742a1.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ae9495a-aa87-4659-ac1e-eea975984552.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a76b80e2-feaa-44b9-ab42-be947956d4e9.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2000e354-5d68-4d8c-a0c8-2e2573022ca0.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\948cf026-1670-4992-8f7f-4b96a6c3d377.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a1bb2c1-b363-426b-b95f-ce456d8f69c6.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a492a62a-a15d-44f8-a9b9-6ead82770f51.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd0c80c3-924e-4f8f-a374-d0a11c822418.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ae43929-e088-4ee7-9255-98955038c4ae.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dda5a99-c63d-4fa7-93b7-d79e25a26bff.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\673a336f-73b8-4f68-bd06-10f489c82bdd.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b5b43b9-f543-44a9-920d-5c22f656385e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92f9a7e3-2640-491a-908e-fe163d53783d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e22b12d7-31b6-4419-958e-d78f24436df9.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4966e0d-a53a-41fb-b9a4-065350694b1e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bc05dbe-3554-4244-bd3b-f590c4777cc3.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2948fdc-4c0d-415a-9428-44ca69e800ae.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29460216-0301-4c7e-9671-dd0001601d3c.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c675b5eb-b23c-4e2f-afb3-4517fd539f9d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e56c2d84-c6ab-4c37-8ec8-68e71ac6f835.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30e8c35a-2400-4c84-b3ba-dc66981a88ca.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:660
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3ca8222-6523-4b9b-82d7-b893f31d2b5a.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4418809-adc1-47be-9064-762d02289bef.vbs"
                                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da55af61-e03f-446a-ad3b-1f5c6c5a525e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81ffe7db-4fa5-4ad2-9efc-5926c65f87ce.vbs"
                                                                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bdd3e67-ccc6-4e1e-aeab-93fd5722a5f7.vbs"
                                                                                                                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2204
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf50d9ed-8408-43e7-b2e0-ea108de488be.vbs"
                                                                                                                                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1314d96-4ab5-4524-93a8-7df27c71d67e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4dace78f-78ab-4c22-8d28-ae1b8edb851d.vbs"
                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:288
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e88ef4a-edc1-4ba8-93d1-9bb123715f89.vbs"
                                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b3abfe5-f1ae-4059-a59f-466e5899667e.vbs"
                                                                                                                                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:892
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a859eb28-b341-446b-8352-5f398ef63344.vbs"
                                                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a83871df-83b6-41e6-8149-903a40cb6eed.vbs"
                                                                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2956
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da6b0699-24d4-4a18-990b-c92fa0e18723.vbs"
                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1544
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c2e122c-e768-4968-815b-17c49d9c5ca9.vbs"
                                                                                                                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1704
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\895a2767-4bab-4a47-ae7a-4b1a18a8d69d.vbs"
                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:888
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1780aeee-1785-40b3-b2d8-d09cf70b4c49.vbs"
                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d777665-faeb-40b7-872b-d98b7988a5ed.vbs"
                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2796
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a0481a3-07a6-4ef4-b5cb-e7d69a23c865.vbs"
                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2516
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\992c4ab3-958a-4490-95d8-c5c35688f8ec.vbs"
                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55434e1c-9990-4c4f-86e9-a9e79206dfa5.vbs"
                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                              PID:700
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbb38f05-7d1d-4540-9896-56bfc862f4d1.vbs"
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3f059e2-9e9a-4bce-ab65-1cc92c6b333a.vbs"
                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2996
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WScript.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\914e456b-f808-4559-af38-f00cf24be4c5.vbs"
                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                        PID:856
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\lsm.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:896
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\lz32\lsm.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\winload\winlogon.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\PerfLogs\Admin\dwm.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:820
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\bthprops\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsass.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\de-DE\ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\spoolsv.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2668
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Documents and Settings\services.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\PortableDeviceWiaCompat\wininit.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:1868
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2420
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • DcRat
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:2996

                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0dd67e95-d470-4149-b9bd-e90a8599c7bd.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              5cff3aadf0fe0580b22d76b0abc35dd8

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              01b58b7f1ed212d8adcdd1dc464de167657fd742

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              04311949b221a857d3d2c6efaed8e62511c0b12caaa49016a45d2e76429dddea

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              6507f2d54003c522591f3c9d33268466b20d4c1f8f1302bfc12469d507e749bd153415ef8283649a88b9abdeb48794237103d165eadce570a86e242441d29afb

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\14aac92b-1a3d-490e-abfa-d1470bd0e252.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              6e0439acd073b5afe841eec2f63c74a3

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              f5fa64ca39e025556bd52346d62fe6873580233f

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              c110617bfe79f6438bec029c118f7b6f794977e9cceaeb5d80c91d33a1129d18

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              85eea6c4fec65935802a14fd9ce5ae8e2e40e654369c5dddc87f5da69a1af6a835e3bab761f027d0fd7e5abb595014f68d9794eb9d228cb35ba45ba55fd52f34

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1e8bb6fc-aaaf-4d41-b589-64e7dadb7b1c.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              fa09fb6aabddadeb853ef95329d2cd58

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              70457350d15efed23ba42351e719179842a340b5

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              ec933a195c422f1d4205734d2ae09b7b6a2be80faa89a4a1661b4127b429c003

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              445b0d682fabd8c3a96a0eee7a7d3e1f9cfb89916276c00fba29215849f2e1cf330c005d90b984a379ddd6ded4168ec336469bf7e093c4df06c89a9edf88759e

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31e796bf-3d83-4555-8da0-408ce95f7199.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              1c791581c5caf8ff4fb5b647aab5a951

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              f689a6d2cd94e6027131b2ad0f87aa6b5baaa847

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              e42bfda2df450777436f49a6aae422884a051593f7b32840494d8901e0721418

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              5900629d90c5fe6671f2b68b070bb4cd795f683c8cccb42e3c22c418d2fe4128178f320b4c8f2c5e5b7358bacff209c868bdf48462e787d66ab9c69c46df6cba

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3e581f7a-a26d-4827-bf37-41f28aa734b6.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              fa7946a62a81ebc5b4b4b2e1330bb4c0

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              adc1adaec83c8fa96edf6ba35d42562444e70c98

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              46ea0d24a6bba2666c015d1e2a9782439b1f6f07938466a83795460025499729

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              02592dd4c9788c88ce75de98dc9cac9cd990c58f1d4392eb021f7619391b0b77b17ffeca2a5fb1344b4bde991c691fc4c2aee9677de3088adb9648882e337106

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\46e73f8e-a85d-4f39-9a4e-a800329e3beb.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              750B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              d0ee3b6e381fb5e3509b5fce5ee0e350

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              e3eab21929a1b438f216572b3562c821562a1a1c

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              2c4a639b3204f532a517e653240e748261a23f8644a553ed6698b730e867567f

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              4cf9c4ba09ca022bf95c71a5097c1680234759e22e0843927b29a84ce3710adc0a4b3f87c0b7dbea98df69291b27eecfe0b7de8aa8010bc2a4f0e59a43db0edd

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5d7c16aa-8fc8-4c03-9194-c17f89fa6f5a.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              0c24ad9424ce6ca3352d71dd203923fc

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              8be2d4d4f91d3e419beca8fdf44fa3bd805a1568

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              1b7612bf6c65b101ea88b5f526a235020455248188647e419a91e345cc73f0ec

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              585d5bef03886b1e1f6e2eefce4f0c569934ca52294717338fcc6af1e9bc8f92d6dea21f540f878fd1984267401fd2f67400844c0806064d654cce6bfc08fbb3

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\62bb5bfc-90dc-4ce1-a8e2-c6dc6b9526f3.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              1e07bfbf5df25ca64f5f4e29c68ddcb1

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              367ff18e26222124e602f5471a4a639167d8f850

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              b3c1ebd7f2c92592aa511043246492c04f2b49a1f5bd21fb67d0289a8136d277

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              e6d856ab282362daa8669b1ddbbbcf162e8d960e807173936f60d6e7f8e857ed0c513e564df12e17b654a6ba189747fef726f5872a3e32fa0f8fbe2790004357

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\79d9bb9e-5630-47d5-939a-81bdd3c6da06.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              b9cd497d56d31f8a5d0600f3ea17cee8

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              b1a8c44d990ed7da3cebc59e03219a638d8d349b

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              5cddb7e322af7a28167707155a329b2874dfb71e91b54a4d90e78232f015c76b

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              6789b3f5730cbf44f758250d5709bd4293b5a626e4d1b24b1e9890c3b3a95639577e57c4a060eba84fe0f2c2393fb1384eee5ea4e39748aa9189ca3f91c2f426

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\914e456b-f808-4559-af38-f00cf24be4c5.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              527B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              2b13d87fe45d1746183a6cbdfb5ec056

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              b029d9570d19990d3b48208d922e7c97f45d2f81

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              246db84f0fd9f359775d884713755e06e4edf3273f299aee3c74a22bd7be94d6

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              2d936022208ede73faa70d57ed44d05a8ce8d44e706126431f0a2b79b8cd7176ed806c1995b465830c0baccfd95af7ab2c6594556775b9c64f4ca786b968303e

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\961bf867-5423-46b7-8d01-e82528c8c8ab.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              4428fbf4d2dd0ca113ae66f156d23c43

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              af3cb68f1ab1e9bb98929f655e02950956cabd18

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              38c790265c0471107398be10fe7ea8f1dab945d9d850f1465585db015fb0a39f

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              414ef409b3b554eb3afdd930bc0280e1fd5f4afd352216fe52fe98abeba8681d0c318f494f9b3ae4a602798066f7b1a328cdb86b40de690b6bea47ded53f05f8

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\D2nBQS9KNh.bat
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              239B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              e9e7061c435c96749b6b704e758c2170

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              ad2fe4e3dc2b56855bf15f002a6e2bb7cc3fefc2

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              15704344f624010598c9e7103ce483352fc3ed9bb57c66d569dfb08e100253f2

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              d06e05fac05eba8c4ec84606255c894a2538efafd5ae652c5a3d5930514ad5c90c1e3ec1fd196b455db9ac302a4d44068d66d20d001b24608744a3b048a93ca7

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Pz54l4hn7h.bat
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              266B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              2053a084bb02e2b12a22409e60a4faba

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              071e960740985aaf44b35fc6f0bc4f2776198a79

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              7c3defa076dfa6421624335a74980cbfbd2e43b2c4fc052c22889277b417c3d7

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              c1da20eb441eedabc0c9e627e470efd4091ed8f219c767c0648404871387776ab90d7d43d0d4856d1fe6ceec972dffb7e81d317ec31aefc72725ff6bed6bf8f2

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a633abc5-4ea7-4dd3-9455-4e265c09f95f.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              750B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              27cd945216d0238543b9bc4978c07568

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              b0aa5f64624a2d9f60f4944a1493dc2a58d59335

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              4960ed67a4b4187687da890ed13b6a94c3e0dbbbcde88f46a4dce9034f0c5080

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              aa9ce386620d17ba4bf3946018b5ec132352d7ba376a9cf758aee3434c5a56aade3473bece63599c9c3b84d693f2dee32b18e7b348e5c7bff843c0a32aa3eaee

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c01cf770-fbc8-4c3c-b3fd-f670bb2aa132.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              15cde1584e306b8fc4ee8507a7dc1866

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              1066f92ab46d742f50b3ee4c6e054a27fd46aefb

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              b835bd515828affd72195a9380fc99d4c5a8c449742cbcdbd802744ec810ee32

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              cd0b76b6bbb94f2c36a7ef23338d798ea131f1cb080ee90cde0177236afb6c0c9ac12ffb7f2a5e5d417116002387eb2712bc9322278601a64ba2802d1b40f17e

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ced6265e-4976-4a91-84ac-c49a1a1f9c2e.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              335fe90bf04d66b50b202d3504f042a2

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              1ded8c9b31727df634573e29c428e3ca89e6c5d3

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              677162789e59bbc0708ea3caed2f545055e1c438009b400c11458ceb3c33bf52

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              6902fc0822294a8b90cb9c79d3517e6e9fc9370e1bfa8d95058a6d3101e2ff7f634df9b9bb4f56bc76caa20c8eb2eadb6d8afc459cf473216281be21d4511e48

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eec580d3-44d2-4339-a9d7-e0a61d8a2114.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              750B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              ac3fe240ad58cf58a8b21b3cf81a44e0

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              1c530aa2c3b5de03d575a04bb55b861684b4d772

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              de98ec3c66250e1b9902d2c241feaf30c7f7091a50e09b2fe535fce5ba4fac45

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              63468a8e167f78ac8d89beb39a013d1a230d46aa713a8612fb46471d7b375ccaa8eb1c317b0f45f5a01b49454ef74d46bbf33fce17261776cdfa8e6f76d9450b

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f076f326-fc17-4cbe-ac48-d915160e5e49.vbs
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              751B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              d815721a2d4b9c582671d3f2d886dc84

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              d14d5812e9d846f586b3ef068f998b4c4e4e504d

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              a8ca2eb323f47a9e1a9427ec412b87741776677cd9ad2a603cc7492f2f8c6bb1

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              b8e64eb8f0011c72ca5feb1fd33d9daeccec8ae702cbb4097a44bd1ee21456def616db32d2767fc855239eddd1873da5d8bb1dcf8e8f0ba4cfdf10623a9e0637

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f36c19c0594ebb886dc55e1e2a7040ff3f1e38e04.5.273f27bd703f4f26926fc190021d65d71a2f1b9eab
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              796B

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              6ea17357f62b9cfdbf0651cdad63207c

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              277a53f585edc0fc548dd73c190c3aa7514e02d9

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              ecd643ae5b749e950982cac89119366369d81867bc4bdeca28645cc175028755

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              162dd190ed8a9c1287cfa461e5d782eee7094fecd244b1cd841f21195d9dea9f3ed64750ca809a6a442a4a1a13c90a10a07eda74e7003e7d3d41d2df04935917

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              7KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              f9a9e6f7883b6a66e7ab66d2bf2f921c

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              c521544af869c99c8682daf7d795b63a2874c838

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              835e950ec9d0bec5e7a23dc5ae0f47001539d391f6260afacb95ad7e7e999e9a

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              d37f4f776a33a3625a3f22d0c48f38816559c401c480240195a17ad464e8fe3f06d73e01a769ed70af1b8bcceaecdea5be63d937e9a983ea37682ba10baf0cea

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              7KB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              7b39779a9ee712bbdf1afc2871f062bf

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              b022596848db4886b174e96326d636954a9505d3

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              8fa4c07f491dc81fd47106a05803c2834eadbcdd3cb2b83d591f964bad6b827c

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              a6e1c98eebc229f309c22dec214f3c212520e41db6548999e29e37fc0ccb72ebf59540dfbcce53c25346a8849c27035990f721041a4ae5fbc2a830d986b48ec1

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\bthprops\csrss.exe
                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                              207f37be38ccbb0fe77bda8d4ab69187

                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                              97a4aa79a700e336ca8450bfbf38d7e18215173b

                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                              ec455e7827ad85aec51982eb1e0e3653ec13ee2dba778b72e1fc564c1ebeceff

                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                              34350185b31d087e3d9027bdaa382497c061d68fd9d30a201d2563598fdaf2ef05dc8f08f27bc13af0303fc5694f2fea997e1ef042168e705cc83c3f23f6c93e

                                                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                                                            • memory/592-700-0x00000000003D0000-0x00000000003E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/624-334-0x0000000001270000-0x00000000013EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/688-311-0x0000000000E30000-0x0000000000FAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/784-659-0x0000000001140000-0x00000000012BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/908-548-0x00000000013B0000-0x000000000152E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/908-549-0x0000000000550000-0x0000000000562000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/932-430-0x0000000001030000-0x00000000011AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/956-477-0x0000000000A60000-0x0000000000BDE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1144-453-0x0000000001250000-0x00000000013CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1200-215-0x0000000000B20000-0x0000000000C9E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1200-216-0x0000000000660000-0x0000000000672000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1280-469-0x0000000000080000-0x00000000001FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1288-604-0x0000000000F50000-0x00000000010CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1300-438-0x00000000004E0000-0x00000000004F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1324-185-0x000000001B5A0000-0x000000001B882000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1328-263-0x0000000000180000-0x00000000002FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1484-398-0x0000000000A40000-0x0000000000BBE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1488-732-0x0000000000D00000-0x0000000000E7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1496-589-0x0000000000DD0000-0x0000000000F4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1500-565-0x0000000000880000-0x00000000009FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1524-422-0x0000000000A00000-0x0000000000B7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1564-368-0x0000000001280000-0x00000000013FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1616-493-0x00000000001C0000-0x000000000033E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1632-573-0x0000000000140000-0x00000000002BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1632-299-0x0000000000B80000-0x0000000000CFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1656-345-0x0000000000270000-0x00000000003EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1692-581-0x0000000000990000-0x0000000000B0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1768-651-0x0000000000300000-0x000000000047E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1788-461-0x0000000000010000-0x000000000018E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1808-755-0x00000000003D0000-0x00000000003E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1808-754-0x0000000000050000-0x00000000001CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/1864-516-0x0000000001160000-0x00000000012DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-11-0x0000000000650000-0x0000000000660000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-16-0x00000000020C0000-0x00000000020C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-9-0x0000000000630000-0x000000000063C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-8-0x0000000000620000-0x0000000000628000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-95-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-10-0x0000000000640000-0x0000000000650000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-24-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-1-0x00000000000C0000-0x000000000023E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-2-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              9.9MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-7-0x0000000000610000-0x000000000061C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-20-0x0000000002270000-0x000000000227C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-18-0x00000000020E0000-0x00000000020E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-17-0x00000000020D0000-0x00000000020DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-3-0x00000000004D0000-0x00000000004D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-21-0x0000000002280000-0x0000000002288000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-15-0x00000000006A0000-0x00000000006AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-12-0x0000000000670000-0x0000000000678000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-14-0x0000000000690000-0x000000000069C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-4-0x0000000000560000-0x0000000000572000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-5-0x0000000000580000-0x000000000058C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-13-0x0000000000680000-0x000000000068A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2036-6-0x0000000000570000-0x000000000057A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2044-692-0x0000000000150000-0x0000000000162000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2068-763-0x0000000000AC0000-0x0000000000C3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2068-684-0x0000000001090000-0x000000000120E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2108-612-0x00000000010B0000-0x000000000122E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2108-613-0x0000000000350000-0x0000000000362000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2124-708-0x0000000001380000-0x00000000014FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2180-621-0x0000000001390000-0x000000000150E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2220-390-0x0000000000250000-0x00000000003CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2272-716-0x00000000001F0000-0x000000000036E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2280-779-0x00000000003E0000-0x00000000003F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2280-778-0x0000000000CF0000-0x0000000000E6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2356-127-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2356-121-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2468-501-0x0000000000160000-0x00000000002DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2488-251-0x0000000000A80000-0x0000000000BFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2504-406-0x0000000000C80000-0x0000000000DFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2520-187-0x0000000002290000-0x0000000002298000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2620-794-0x00000000003C0000-0x000000000053E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2628-636-0x0000000000260000-0x0000000000272000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2632-287-0x00000000009C0000-0x0000000000B3E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2672-275-0x0000000000120000-0x000000000029E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2676-667-0x0000000000150000-0x00000000002CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2684-724-0x0000000000BA0000-0x0000000000D1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2692-227-0x0000000000310000-0x000000000048E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2700-675-0x0000000000B10000-0x0000000000C8E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2700-676-0x00000000003D0000-0x00000000003E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2736-557-0x0000000000230000-0x00000000003AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2824-414-0x0000000000020000-0x000000000019E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2848-485-0x0000000000CA0000-0x0000000000E1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2928-239-0x00000000009D0000-0x0000000000B4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2932-524-0x00000000004C0000-0x00000000004D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2952-135-0x0000000000BF0000-0x0000000000D6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2988-540-0x00000000002D0000-0x00000000002E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/2988-539-0x0000000001200000-0x000000000137E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3016-353-0x0000000000FD0000-0x000000000114E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3108-855-0x0000000000D30000-0x0000000000EAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3108-856-0x00000000004E0000-0x00000000004F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3136-832-0x00000000003E0000-0x000000000055E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3136-833-0x00000000003D0000-0x00000000003E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3148-802-0x0000000000940000-0x0000000000ABE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                            • memory/3776-817-0x0000000001220000-0x000000000139E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                                                              Download