silverrat | c7c78f431c21c05d2963fb7635b73d969b7dada294252ef1d2b634b030a2375f

Analysis

max time kernel
123s
max time network
198s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02/02/2025, 18:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Silly.exe
Size

45KB
MD5

1cf8d6e0acaa084d9b4201f11a1a04a8
SHA1

7cc576ff7a096e14a6e83836bfd3cd29f7164392
SHA256

c7c78f431c21c05d2963fb7635b73d969b7dada294252ef1d2b634b030a2375f
SHA512

de6889cffba397b9a95b02d3271b14c9abbe543fb2a4415182cb24e9a3cf152bfb1ae5d3237eacac613f411fc278d120191f45c5cb1c4ca5135f393b57c0527a
SSDEEP

768:iqzAMCV2799XtzcyyMjtjRULQD9PpnUz1QB6S9RVvr0/bE:iqzAM8qfzcMjGsD9K1QoyRVA/bE

Score

10^/10

silverrat defense_evasion execution persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

if-eventually.gl.at.ply.gg:17094

Mutex

lAxDBRhAFu

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discord.com/api/webhooks/1335679503938355221/lGcOUDspps04wapqxq013W8uYGPSCcmnxl9Q1xnWdBn45Ul8QBT-Qs2mjsdVNXfOtTCe
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
4
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4608	attrib.exe
2532	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	$77Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\WinTask\\$77Runtime Broker.exe\""	Silly.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
684	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	discord.com
1	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1612	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2372	schtasks.exe
1652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
1496	Silly.exe
684	powershell.exe
684	powershell.exe
2040	$77Runtime Broker.exe
4796	powershell.exe
4040	powershell.exe
4752	powershell.exe
4016	powershell.exe
4016	powershell.exe
884	powershell.exe
884	powershell.exe
4796	powershell.exe
4796	powershell.exe
884	powershell.exe
4040	powershell.exe
4040	powershell.exe
4068	powershell.exe
4068	powershell.exe
4752	powershell.exe
4752	powershell.exe
5108	powershell.exe
5108	powershell.exe
2516	powershell.exe
2516	powershell.exe
4016	powershell.exe
4016	powershell.exe
4060	powershell.exe
4060	powershell.exe
4964	powershell.exe
4964	powershell.exe
1124	powershell.exe
1124	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
4068	powershell.exe
4068	powershell.exe
5108	powershell.exe
5108	powershell.exe
4000	powershell.exe
4000	powershell.exe
2516	powershell.exe
2516	powershell.exe
4000	powershell.exe
1368	powershell.exe
1368	powershell.exe
1124	powershell.exe
1124	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	$77Runtime Broker.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeBackupPrivilege	3080	vssvc.exe
Token: SeRestorePrivilege	3080	vssvc.exe
Token: SeAuditPrivilege	3080	vssvc.exe
Token: SeDebugPrivilege	1496	Silly.exe
Token: SeDebugPrivilege	2040	$77Runtime Broker.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	5312	powershell.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	$77Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4608	1496	Silly.exe	81
PID 1496 wrote to memory of 4608	1496	Silly.exe	81
PID 1496 wrote to memory of 2532	1496	Silly.exe	83
PID 1496 wrote to memory of 2532	1496	Silly.exe	83
PID 1496 wrote to memory of 3504	1496	Silly.exe	85
PID 1496 wrote to memory of 3504	1496	Silly.exe	85
PID 3504 wrote to memory of 1612	3504	cmd.exe	87
PID 3504 wrote to memory of 1612	3504	cmd.exe	87
PID 3504 wrote to memory of 2040	3504	cmd.exe	88
PID 3504 wrote to memory of 2040	3504	cmd.exe	88
PID 2040 wrote to memory of 1404	2040	$77Runtime Broker.exe	90
PID 2040 wrote to memory of 1404	2040	$77Runtime Broker.exe	90
PID 2040 wrote to memory of 2372	2040	$77Runtime Broker.exe	92
PID 2040 wrote to memory of 2372	2040	$77Runtime Broker.exe	92
PID 2040 wrote to memory of 1604	2040	$77Runtime Broker.exe	94
PID 2040 wrote to memory of 1604	2040	$77Runtime Broker.exe	94
PID 2040 wrote to memory of 684	2040	$77Runtime Broker.exe	96
PID 2040 wrote to memory of 684	2040	$77Runtime Broker.exe	96
PID 2040 wrote to memory of 1652	2040	$77Runtime Broker.exe	98
PID 2040 wrote to memory of 1652	2040	$77Runtime Broker.exe	98
PID 2040 wrote to memory of 4864	2040	$77Runtime Broker.exe	100
PID 2040 wrote to memory of 4864	2040	$77Runtime Broker.exe	100
PID 2040 wrote to memory of 4796	2040	$77Runtime Broker.exe	102
PID 2040 wrote to memory of 4796	2040	$77Runtime Broker.exe	102
PID 2040 wrote to memory of 4476	2040	$77Runtime Broker.exe	104
PID 2040 wrote to memory of 4476	2040	$77Runtime Broker.exe	104
PID 2040 wrote to memory of 4040	2040	$77Runtime Broker.exe	106
PID 2040 wrote to memory of 4040	2040	$77Runtime Broker.exe	106
PID 2040 wrote to memory of 2532	2040	$77Runtime Broker.exe	108
PID 2040 wrote to memory of 2532	2040	$77Runtime Broker.exe	108
PID 2040 wrote to memory of 4752	2040	$77Runtime Broker.exe	110
PID 2040 wrote to memory of 4752	2040	$77Runtime Broker.exe	110
PID 2040 wrote to memory of 4320	2040	$77Runtime Broker.exe	112
PID 2040 wrote to memory of 4320	2040	$77Runtime Broker.exe	112
PID 2040 wrote to memory of 4016	2040	$77Runtime Broker.exe	114
PID 2040 wrote to memory of 4016	2040	$77Runtime Broker.exe	114
PID 2040 wrote to memory of 4760	2040	$77Runtime Broker.exe	116
PID 2040 wrote to memory of 4760	2040	$77Runtime Broker.exe	116
PID 2040 wrote to memory of 884	2040	$77Runtime Broker.exe	118
PID 2040 wrote to memory of 884	2040	$77Runtime Broker.exe	118
PID 2040 wrote to memory of 2364	2040	$77Runtime Broker.exe	120
PID 2040 wrote to memory of 2364	2040	$77Runtime Broker.exe	120
PID 2040 wrote to memory of 4068	2040	$77Runtime Broker.exe	122
PID 2040 wrote to memory of 4068	2040	$77Runtime Broker.exe	122
PID 2040 wrote to memory of 4388	2040	$77Runtime Broker.exe	124
PID 2040 wrote to memory of 4388	2040	$77Runtime Broker.exe	124
PID 2040 wrote to memory of 2516	2040	$77Runtime Broker.exe	126
PID 2040 wrote to memory of 2516	2040	$77Runtime Broker.exe	126
PID 2040 wrote to memory of 4584	2040	$77Runtime Broker.exe	128
PID 2040 wrote to memory of 4584	2040	$77Runtime Broker.exe	128
PID 2040 wrote to memory of 5108	2040	$77Runtime Broker.exe	130
PID 2040 wrote to memory of 5108	2040	$77Runtime Broker.exe	130
PID 2040 wrote to memory of 2232	2040	$77Runtime Broker.exe	132
PID 2040 wrote to memory of 2232	2040	$77Runtime Broker.exe	132
PID 2040 wrote to memory of 4060	2040	$77Runtime Broker.exe	134
PID 2040 wrote to memory of 4060	2040	$77Runtime Broker.exe	134
PID 2040 wrote to memory of 2968	2040	$77Runtime Broker.exe	136
PID 2040 wrote to memory of 2968	2040	$77Runtime Broker.exe	136
PID 2040 wrote to memory of 1124	2040	$77Runtime Broker.exe	138
PID 2040 wrote to memory of 1124	2040	$77Runtime Broker.exe	138
PID 2040 wrote to memory of 2276	2040	$77Runtime Broker.exe	140
PID 2040 wrote to memory of 2276	2040	$77Runtime Broker.exe	140
PID 2040 wrote to memory of 4964	2040	$77Runtime Broker.exe	142
PID 2040 wrote to memory of 4964	2040	$77Runtime Broker.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4608	attrib.exe
2532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Silly.exe
"C:\Users\Admin\AppData\Local\Temp\Silly.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4608
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp877.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77Runtime Broker.exe
      4⤵
      PID:1404
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77Runtime Broker.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe \"\$77Runtime Broker.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2372
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77Runtime Broker.exe
      4⤵
      PID:1604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:684
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc hourly /mo 1 /tn "Runtime Broker_Task-HOURLY-01" /tr "%MyFile%" /st 00:00
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1652
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:2532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4752
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:884
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2516
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5108
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:2232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4060
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:2968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1124
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:2276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3948
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4000
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1368
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5312
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5564
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:3132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5520
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6052
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6180
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:6296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6372
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:6504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6580
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:6732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6828
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:6948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7060
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:6196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:6644
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7412
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7676
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8104
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7420
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:1548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7828
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:2896
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8292
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8520
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8672
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8956
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7280
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:9164
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:9308
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:9512
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:9684
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10012
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:9356
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10144
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:9372
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10404
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10556
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10884
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10588
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:9540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10436
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11492
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11772
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12032
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:12140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12256
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:10908
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11624
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:11512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12408
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:12480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12572
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:12704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12824
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:12948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13048
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12292
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:12508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12936
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13272
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13528
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13728
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13952
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14168
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12456
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:13268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13636
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14484
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14772
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14896
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15044
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15184
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14568
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:14848
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15120
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15520
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15628
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15908
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16044
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16236
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15492
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15564
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:5204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16416
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16572
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16796
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16860
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17088
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:17208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:17368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:15756
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:15236
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16728
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:16904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:4420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:17448
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17464
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:17844
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18120
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18224
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:16648
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17000
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:7008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:17544
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18548
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18656
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18776
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19012
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19088
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19276
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:7596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:18484
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:6764
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18332
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:17652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19464
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19776
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19840
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20260
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20288
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20308
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:19492
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:18876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20876
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:21484
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21492
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20652
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:8268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:21588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:21648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:21656
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21720
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21736
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20812
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21004
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:21704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:21792
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:20696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20920
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:19904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12336
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
      4⤵
      PID:22632
    - - C:\Windows\system32\shutdown.exe
        
        Shutdown /s /f /t 00
        5⤵
        
        PID:24752
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:22796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:22804
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:22812
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:22820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:22852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:23316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:23452
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23460
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:11740
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:23400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:12360
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:12940
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:23636
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23680
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:24008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:24080
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:24484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:23196
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23844
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:23940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13916
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24300
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:22660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:20572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:13648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:24208
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24776
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24784
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24912
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:25016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:25296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:336
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:4808
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:14660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:436
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5024
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:308
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:24304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:25336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:25696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:25808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      PID:26380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38c5055 /state1:0x41c64e6d
1⤵
PID:25552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
62KB

MD5
e566632d8956997225be604d026c9b39

SHA1
94a9aade75fffc63ed71404b630eca41d3ce130e

SHA256
b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

SHA512
f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cm4guwrt.szu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp877.tmp.bat

Filesize
196B

MD5
6242c2452f249a94c58aedf1b7853650

SHA1
e9d8316f94de5178574020e7980445cd7360d08b

SHA256
36ddac0312f9f555490cf02b315efcc3bae8db73d7a5e1a4b50137ac005f44e7

SHA512
3926c921019bb6146b210a2f81159029ea6fb2face49f2f843cb66c0e8993efe82556f54cc46b6df7f75e0ebdfe2549a0540feef678a87769a514c674227b441

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
00646c9a2157ca63f6f13f7360b56bf7

SHA1
9ca41533d54a0ff682745001b4d28a7b7320d9f1

SHA256
b42c1bf72b84bd3a93f397d6426ed2f09373f48fc27d7368cc0a13b117d0c506

SHA512
276e9eee846462e5ff5d8c6cd84821d63f33cafc95c4601b6ebce01646989aecee1923775e5f83085a399e0cdcba2139cfe5de2486d1f0c92a0615e0a2bf5666

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
61b6cb35ac823c1f4f00c7d7c15a3996

SHA1
c6f4c056ca53c36909c455cc732753b59dc961cf

SHA256
2b86911442a4cc57d732a76e6615aecdea3f4782cb2b96ba45c09deec21c004b

SHA512
052ae612f76d8dc35dd932b858493c9c16224dc4d6cc9a78735b97d04b4c22075be4f26eb10bde6876f84844a3c892abfa04e1203772e59a5fc0e4e9bbadbdb6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
518cb5003c13901d3706e18c8b5167c6

SHA1
42908fd15dd3b88fb6fdd24b66da2db4453af366

SHA256
4b03d7c54653273a2db7e23d5757f35a9d72db32cdf354f69b10e5e4b6fde660

SHA512
a4da1fe32a31a4d26d6067707bef14ead18916f3031b09f0fdb34470fa2ef4e5bdfeeb69f5fa3d9c72e4ba2b1e5b2b9e2da6fd18681e9b10ebc917028aa8639a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
1389c3e4c437ef97617ac055409f6f18

SHA1
dd60f1a8cc12243e703ec30935c473c99e1cb79d

SHA256
994326f889d0a18f20b7f6a78e6b9aa90225242a2c05f9abd47f3bb3b19cd439

SHA512
f15da1eb62ecc6b6747e3b4b494f7b358fded3add3f7da5398660921984b341d6d8985b909defe013d5cb025aff258489e83c280a5ec97342008203594144009

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
1d6b8fb84b48bca0de2db8d5a690a672

SHA1
50300a294a753a15b566ea483e816af81228108b

SHA256
67f4029892b18c00e51e9bbd83fbbd40cbe470b79b6de4bb238c16c9990a5618

SHA512
90d80885664c8dd7f61a0f9fb28a4c13dbd1e2388324a6dae80c4f6a9c8d1080a3568f57dac6a6f63291171535ef8f871498022039c1fac329272e3f549a03ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
8d18e6bbab220a5cf394842d5ace8f5d

SHA1
15eb0c996c45e0bdbfe0b20442b09eb923acd134

SHA256
fec3ead83e585f555606a29b184f2486332ce898212b7c6ffed5d8fb17a9139f

SHA512
f82d199c5c9e40dac5651b6ca4f79eeaa88578deceef5004d681f5ebb94b52253bdb8d123a20453694d99fd09171e08ee9a03a2a33bd0ae32acabe80d215cbda

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
f231f96be121eb3027b7855167994222

SHA1
a235182bce50bc81dfa4356b849cb0aa231bd64a

SHA256
ce5de1b4d0062cecbf8cbc7094fe41b311d9347eea4f7f91236bad263600ddba

SHA512
6cbc849b3c8ba745c2cad5000e59c425511bdfb5a5884f26088a9327e1902f205555158f900dc61504bb4cc6589e6e110b137065e1eaf81f212a17216c47450c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
0819f9386eb7e36920ba37e049e577a0

SHA1
8c9048146521d11c28c2cd3bfba12c342d6b4d15

SHA256
3340428f3bb672ab7e6faa28735e23944691a5fe530ea5f731781afd7f16aae4

SHA512
42cd9f8c17e1ed32c9734cb45ff87f9af584b556da0e0b74b7dff8c22926c30b8054fc3021e8c966a4f4691399cade480f2fe8d6d786729b9ea972d55492f5c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
5e434426efc525a414e9f8a39aa255e4

SHA1
7410cd858ce0db32497ff89885a1f033c713161b

SHA256
00b47668b84a8308f829b4c15cabf2e546b63c5515ab80047fd81166380db2e8

SHA512
ba01d82cf0bf9dfaf98f55fe3051159fec96bd82a04f3055aea15a64ed7d2cca2ac0b0fda9aa19f3f047dff994da978aa9a47d0ea7ebf3af211703c6dc3a1cbb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
cf75f6d4a16fd6dff50b621db3681452

SHA1
ef60ee7261077a8e2d644c63a5552e977e883839

SHA256
73c093d9d9b8b23d3c870f517d6b0ca23d412339deb2707e436f58163b2b65f8

SHA512
75f47df33886b976d6a11ffc669179850e2b847017f3ce829257252192726e0cb573742cf756773ebeda72d63837874c3e7544c90b52afe04d3a29a19b87bb1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
c5169bcbae4901e054194800ae24568e

SHA1
3cee81f1e0b7f516e8e9eb870c6647745d6deb24

SHA256
3b82bb88310b7e75a2c24b7532bd3a4455806751668b1810cc77c77df49ae2ae

SHA512
2facc850e10920ced63709446ce437941f8be5e1942f9baed1ccec826702cca97e8e306ada66993fdbc0046639bf8674a4f5a12f166d7e9c15d4cb86eaf4d958

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
f72bd203ddcd962ae631c5a732ff0a8a

SHA1
a43037e2e9fdad86fd560d5f145eb60fc21f6a62

SHA256
aec7141e567abe08edc2e67083f24063d72ed8090e8d07ba6b4ae5a557292ebf

SHA512
d6ca9f0a80bf00d5578b794558feb9e6cb6687dcb0d8dc5d810c5dc9e635232f008f165079e146c2e96e6ff15a11d69eaa394740ed8fadf045040e9c6eb6aa98

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
2caf83f1eb5779acbefad868a0d6178d

SHA1
5590a827f4b6eedc05366a0a599bdb191bc7e5b6

SHA256
b1b27804debaa3477a23a5662abf10f9b4ea4542a7dda1b6c489eb82d7960c41

SHA512
bbb545b88939c78eaa29cef4a98aff4f44ed6b7bfe0469c3d0654df4996ffbb823c106984e48a7f31bda16aaff09e7d8ebd779f90e8c975a48660db61cac212c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
87f20e0f80de504f84b6c326ce7dd67e

SHA1
0f1c424d320fccc3cae9d299c08d4f50618c8159

SHA256
1a9bcc041eba0d91942f8cb5482cd7066a487225377e4f85c091ee0b4f79c2ee

SHA512
eb56b3727a69db6f5077a3d9fc9b48d5db21ad17aaa9ea85ec8f2a3cffe091aa59e3a18082a4af35dc9f3eff31b73a5bf90346403133ac299dc40efebc22f974

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
51153c5c99d293fedd4f29da834aa438

SHA1
25c80ab8298a986e775a2f444dd6a5dded58a442

SHA256
3adfeb0b780285dac39bdf37d1b9074cb8c0a1b7d070772db7ea6b8ae52f833a

SHA512
304d47b13473acaa581ea6c1db77ced34fff903ea8a4b068cac7a3bb03f239596b4ed73c0e1ac4af786ca4dc1fe96c91533df17ae6116e80b7fd515d1a0e2e07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
bc54888f0d9ff6389d77b11f5b302a2f

SHA1
d7f7a45da93e66e14cf7018a35fae6a62fdae5ef

SHA256
5943b0cfe6f532072413b554ff8ace96a4eb60d877816b8b0ed69a31e6293183

SHA512
2edb35765cacc0d29405a50d59426e12f15ebac679b8a69847c3fe66e10f6d252da1689494188c26b9c231c19b51e2b10c22bed70258c50b0e9edec9033bdd04

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
36e5db1aa5a0b12a00ec6e791fcf9a63

SHA1
caf6492e3edb5fc3a68a536bf25c8db02b022b78

SHA256
c81ee8275c1c45cb100cd4268ab06b2819da657ee15da2ab112546dc092082d3

SHA512
0fb96f8f9fda9eb51da62431cd473c0e47be01a7b2bb7208b68af5bc495d63fd580351a47d0bed2d230aa17c86b906c0d32b19bb3b6920cd75609d738601a883

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b0e6349818531b145a749bc43fbdf593

SHA1
476b4fdce1867d24dd71559e86a9701d580ee835

SHA256
ea959a73309192e5b3d0c0b4801af1505b8f543a673d8e61be3a6a771e602250

SHA512
b4319ba1563e5d94707b7edec43c2f0347d2bb509e4cfb397b90a6fe5e6b06bb520575bc82ccd3699439782991888cbdad58942f3ffde824641d3137aba9474e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
0cdd017d9dae8a315aa4a69250f5840b

SHA1
dc4f67c48b1e3ecef7b6abd2f1c79d33b4309317

SHA256
4d2726b941507f546d5c96ce0d5684384176b75a2fb85f63a1ccafe76f37e1aa

SHA512
4ae2c42943ec45f60f0b5651cc947b6fe496203e1d2dd95790c24f061d484c3a831f36d488be51869bdb0115feb0ffb8f3abd2d6423d0ab738b28e67ca7babfb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
13d64581b6ae08d47318e4a230a67b77

SHA1
64b1cd78d999a3ccb2cf3ba9b7a963d27db94538

SHA256
f131becc1451110083cf6a6a741bf18837d2d3fbdf621c548e4f004cdd0342bb

SHA512
9eab8eaf4879cf0363ab257ac6b37c854c28d748140d1e18474d24edd9e306ad23245fe358070b0026ae98b927403d8fd835d1281a73321c5f89342d75c90f80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
99dd77e87f1437b8ac6250b3f44d75e0

SHA1
42f8978036a788c0294b4d3de59b69db80080a75

SHA256
10f216eac6279331f1d1ce61dfcb125800c41df4ffce63a68cab60848f4eeb14

SHA512
06f00afc1f3e9fb45162766ee5a0696573a3b7f0fa98ea01c8344d73d1d9dc7683261307c8e324c5e808f98f1b371c09f996b17f11b2d32eb6c18c09f0e6f4b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
06b0278bc5b2b63eaa789324eeff0d6d

SHA1
2d24c693a441c9c77a06a6be962947910e3a2f2a

SHA256
9b45b4857401ca1a539d6b797ebc1d68549336f190d81365a0ab2a3e9d411c8d

SHA512
4a3d874997130cdcddc10c5e7a48e192ecfdfaa41e4668f5e5ba4c05d356c57be3c4cca4a380d77260e7103dd747e40dd1d167dd83a008d396a17b0fe0df99b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b532c9491691398df684cd4c89a42216

SHA1
ab515b06d84214b3d1dff0ef62791b4fd3e6f35f

SHA256
59cf8931dfe5551805b6b1bc986e191b19f07eb180d2d81b6b8d4415e4e7075d

SHA512
1d771020d010b0b1ed84fc2ce20d344e24be41f3ed60595bfe96a2fc820d7a68fdb14e9aef74837897e5e2560165341ed0cf8d400443937dc30a47d79fcaa675

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
fcc19ff5594a09b8d24e8ff04cb85cac

SHA1
42c03e60a36fef03a7c77e1d0fbc5ee65af12d89

SHA256
a6d2fdaffc0d5ee314e5f50e040084c81f56024979d8ca08a0665a253d7cad67

SHA512
fc26e13d8aa3cea1cd1587a2624480009f69a40f2a9f0340f172d47ab7773cdb65f6fbea401ccb25dcbe6c2f7cb693d76cd830d94592be28cdeda1707184bfd0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
9c5efaa797544fbbb1a2d11b7faa504b

SHA1
39722e47a65ef43cc84ce391680f3cfefc089491

SHA256
1565130f1c86c6091c94f8a7483b376e92f5dc5145d403b9a4b86edfab1cb860

SHA512
97b63b973ff4e2ba0efabac5f37065c33e34b810788c54d3ac6af02de4e966a1585be23de318a76fa0b2cde8a43be35eb1b8f442da3329addc52df618a30cf15

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
857c990f0bb29f2138e35b59c16d1c7a

SHA1
72265e644c735a3f1841f179b0ed605fee935d64

SHA256
2b0f9c8a0fe53d5e4cd65d541b4412c417ac0a96369018a646e91f1bfa7ebd83

SHA512
8387bdda73c0ffac785393eb87ce9f275f41e6f1c2549ef972a6ebdc2d53e57ec4b104e686e8d518d8bcc95a8aff3f9aff79d5c2f31603ac876adc10a777efa3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
f7797e198f9a62ab92d7335290e52d2a

SHA1
ac4c7f56768b0714dc2bdc5b332423564b5f0aa8

SHA256
d92f5799ae7dc19cea55b055f1a28b43b5624ef7665fb355fb1d98fcae7498f8

SHA512
87befa3c4be383c43c849f00c77062292e57a8a2499e4f81fb142cad1675b07df860fcd4c37232bcb3339cd0311e285b6e6c509b8f967be2e001f138ceeb5062

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b1595e48e06b13616db0da4ac4937567

SHA1
7beb29aec74878e181d2c649b0cbaa3f936fbc9d

SHA256
4f7969465c36d75fd6fb5cc3819e644a49690e52e8b09999a54cf7ddb6f825f1

SHA512
fa6075ff803884d25d2aee2739b08a878d68526788f544442754a3ba6d46ab68275a0384fb3670dfc2875ad31d566435c762aae3a28f491c2425df74af235912

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
f270828401308839b8c85c770f76bfdb

SHA1
feded694af279295e1f1871a739b47570b01afb5

SHA256
8a398ac1ad57f838a730190c40843ec0c99f7ecdedaa73ba7320a2b60de1d532

SHA512
e22c13547ba35c9b1234da08699b390bf14aa3b834f6b7023a7c6c855ac07a2c879161eaf50b4a95fe3d7c3ca190f97b8ec2803aed5e7061f84f3a005aa348ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
36c70ddeb4eda0f35bc17c0e62ec01e9

SHA1
f3bb7edc874971be018f0e5d8d84fec67bdb0e2f

SHA256
a0681018cbdc9da8c9d65afa7c077db806953621033fb1474c31bbadd0b0a285

SHA512
3272133c45d572c0a8deaac12b17640b88e5a349c599488e152d8aebb91af6eb6a61457ae5a4c8d35b0f20af9d36e284e3b36bf00c62b215261ca8710a39dd77

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
bc55e82d96c6ce141e48e49dd3d50138

SHA1
a61a3aa16a2add5b57165ccf0ab34ee95568c38a

SHA256
e45055dee9244c208984f34013ea73f2e20c4589dffe18960911f31e87008569

SHA512
6c68c182b3a026891c0fc043ed96dd3007149313501b648a15b718f66ee089cf3cd049868b0b5ade749eec71083b46980543107aa20e8e1cfc199c5ff7abbe35

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e3d37c220bdde081a049ccedf3fdedfc

SHA1
742c5408f8398039a40a13845ab6791920f572ef

SHA256
b1ac3030b35982a7b82addb8fb018a55d6c9dc71fb945096634553633d009694

SHA512
44ac377f1fb7584052f583471d5208baf60213744c726da24d9546581e37efd2c181162f87ae485a1515c3adb6adcc96d78346331dd47816ccd32e69ad560126

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
582b35ea3159b0c595039ebecf566188

SHA1
a1cc0be04327d32b78128e8bd7f49722f3fc6506

SHA256
519c3e4503d19e535aacfe25c416f7cc55ee1366eb86bfd91faad6bdfc6c4cab

SHA512
d6b8278f805adb3e1eb3dd4e98ec0eee901d6999d3ecd67dbf95ca62aa2d153d2a2754afc5a9de3b6c94b1cfdd60b29175dc8539a0dea1362541d305bccd5870

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
d94b0cd3c6d5e242f6f96bd6e864e844

SHA1
daa2df71a34c4782e91ea0f6920ceda020e38d7b

SHA256
72d86ac4379292462d487ac9a9b1fa93c2558be546e16b001c70d3bdb18c24fd

SHA512
7f161b79b1bc8824650065fade8ab76b874fd079b52d598753643db10d7a173e6675e355778893fabc9fded68a4ef80eb55a2b88318512843c23a5f7f37e4f62

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
5486994f1e94b527efd11ee51d82a1d6

SHA1
14dab8667c6bdea997f3ee82e18c577420841f28

SHA256
c0d233b80613eeb77ab842a3d823d09d30c60935b1e92bce568d6520e96a9ac4

SHA512
e4b9d2f2bedfca64214a5a58dbe3dee6a40ab3e5d23353ca406e314ceecd2ec51643ee7c7f0d2f6cafc92bbd332c07514874f7363a70360c29843d2393a8bee4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
fd76b9958dcb2b724ce3ee1216b2fa28

SHA1
b4e6069dff4a1ff32363f243ef4b0483999ea22c

SHA256
db41e90682c36a23618a871e1a10c0cc7a3a232a9b20c7627b2d0ca6bd73a538

SHA512
8ab151573e6c6b05ee53a6b4ae3fea7ec69d3ebbb2947353d2657c0cd98a0523cfc75441958027141c58265be7ae6489447a010c83f7c2009a339fb890210df5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
8863d6a1ba58abd64264604a9d4200c8

SHA1
fdba88ea86111866b14de9b4388f9448a9ea8c4d

SHA256
e90a3f62bd85321bd1316dfb60aa6a06f9baf07f758e0d858309df421e202931

SHA512
ce29c11da0a0fef0e9d15be3f1cf4bf2835f7f9bd88e46c2906bd02b87b635dad340ec0fd42d74b529c031c6bf7eee768f839e207d6ce06191d8bc1b6326126b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
cabb7d7bdeffb5d59ba46840c9a6fe3c

SHA1
937159a2a82ebd71b2009c738965b7d8f794616c

SHA256
9be2e321a880a3bf6c5fad8bd3f53d0ab486bcb45046c67efe207db62cf36e5e

SHA512
1c8530c10b7572904e3807de409f59bd1c92a852746421a25b2e53bbd61df8fb15f9471cee1adc2e43e12c2ca04018687b410625f4b97d25bbb262088c96cab3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
21c7e4805a03ac5af1c7722ab3df3128

SHA1
62e364484d914b33e52f20e73ce8e384477b60c0

SHA256
e92352c527d604d0a928949a85c8c05bdd197e0d1794f980d157646aac06e2b4

SHA512
940ec6bb520d6139e6b06c0871a60b56db9d374e32aa0d7cb357a35cce47b4fd0d9bbc1642a0f7857e376e676aa3672bebc1ecbdf2e99edd80877069db08b3b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
174bb97da41f40b3184f4fd15883f44d

SHA1
f13b6774c9436662a80bb927be27582c2a5fc3c9

SHA256
0720d166902260e66b37dfcd2362bfeae349d45fe29358068229a9d1fbfbdf1a

SHA512
1fb867e77b0f9049dbbba62ea611fa5714ea837e06021e7d500dcb3c4411f2fe1f7ec31862261dd0365dce405379981cef56f5ec843a5d2e48c2040ec1bdca59

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e7fc20469a9a8f397ba1ed2217f07aa7

SHA1
bb5b1c68d71baf32f41f6e9cdb656dda4ac98ce0

SHA256
d0601cc7dc255cbb79ac17cce38a98f0fa17d6debf22f022b81986001c6d1243

SHA512
be28bf834ce0575923ba7bb1ceb9263ba7a99ba7c89c46cff38f4b89483401f95208c8f25a5cbf9fd80b661b9e338c74be3019003b8474e0d711c5fce5eade49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
47c547a8e0a26006ea960ef30c32f855

SHA1
c71e42eddac4d1be9165f8568d57f2678a7abfb4

SHA256
3f7a050154028e92d31a0d19964bb848b2ca6caf850f082fd2831981d91f39a7

SHA512
d51e31dadff146912f4b037b3e670b3134c7f22c2774db4e6d0363e9f2853c69a85fca9e899c8a1e22000fe44271a5fa9f2851dc28dbf60ceb0b05fb7f4f4bca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
ae03ab65000e0a4b9eb31cab1e28cfea

SHA1
fa4f4e8852f76077fc64a286d1440f6af8dbd2f5

SHA256
730906efe5a8760ced185d8d2e1020c9e44e57ecbdd3a4187d8a814a60c198fd

SHA512
38c50c60f3f528c5bc7473abd4c112e31dd929ea531087a2e04a05974d18c0151eb757f16a847c8b0ad89885821ed27011a482d8b15804f37442bd122ee0e5da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
c98debfbcdc0d6df0cc2a8e7df0a4403

SHA1
b8d855d37c091b45f7d07c62a8c8cef69d7a678f

SHA256
44babf71ce660c7f1ed9314b60a3f40b252d7694fd0d9ff885de5bcacd430022

SHA512
fe40e29b325c5cacf7564a62e98d07b003f49f1e7d4f54603d79bcd352cf7fd8422c36937a4ad9aabe9310749259917e5c4a714b838ba4def3d6325ed5d70d7c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
a1da1f648555b57701fc57405b13ad5a

SHA1
212e1be72b2cb4929199ebcfdf44a4ed73addd88

SHA256
1253fe79b26bf41b13570c5d7a22116d0a1b0247927a3d37360bee7a015d7ca1

SHA512
57034953d93fd5e6f85e3d6acb485036a6da0bd5ba3668938aeea909e6fc7dcb7542bbe9f58870f468158aa94f3b083675251cf5ddc58bf0900202a894884a8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
3d1042d86c0aad8818f831f47f0d45db

SHA1
f952ae40195f72267abc377670a5c6530766d32e

SHA256
43a876bd4f9f6916069060dedd53ce42269f14609239d0a6b3aacec4de9292bf

SHA512
58913a5c4b5ae0a4c56831610bad678140be3e131444dad023be00699f5006ff6cc85c55a9969b9c4f2b995d902c61758d5982424043a0b5250be44581bfc113

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
316b377f3db3f98d0b86bb6ccd35aec9

SHA1
7f586a848cf658f017b66781fee61c41badf5b54

SHA256
adf10b90069ff407221c6c5c128a3425277ad3fdf9cc0c54ef48f3aedd8067f4

SHA512
efa6c91c1e029a898309d4f1d6208da77830b7a626752c91099022ab5874e1d8a1831f9dda8d1b0182c99e3e84ed4757731622ecfea98f7a64b737e579c372bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
9c509d69ea381fbb0cecf2e6924016e5

SHA1
d8130301a7540e1bef72d4fc8f539a16e828193d

SHA256
fb175ce694006be9c5a7ea665bcf7621eac2e4a88391448730693283a638e1f0

SHA512
eb8126acbc950b9954f844b531f78745a0f715efed18f01aede1302696fdfed1430c636e4cc0ef99434e69c112f9cf5234d5badd28c072634b745a3f7684452e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
a0a564e1700c580d542e31f95efece26

SHA1
28a5dcf10aa89660d816190d575945179df89293

SHA256
c7687bfed69ca7dd4ee94df1f0da7028e09526bd19155e57427cee46fcb8f06a

SHA512
27a25101ced8ea9e2a93d1d38303aef961ff98898ec47a9e7c1ba0a4f21aa913d935c99516ef6c10e2642186d411bfb21f11c9260297f504cc27f6381748a9a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b5acfb41c42d970f384ee9ccc20f886e

SHA1
4e435c519dcea98ceef0dcac2dbffc5009060c81

SHA256
ef4febd0a6d92e968c18221e549b337ba4ab8c52b67ced9f523efd6899c3c402

SHA512
e103827ab9307e65c440cda9ad14ed3f816763f3d0cbe604a05c8da454fb20e2a21970d32c203759e71d8302177d787d19f97b81170bb15c9290d3ced03004fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
205c4c5d2b8816e895dd957e1ff40ebc

SHA1
d0caf4a8a4944ca76af87bb406599acdc8863ba1

SHA256
a1fd557a1bedb59430d211c82e514552efd202724af300db7e474e1393585275

SHA512
7a93d51304889a1d4afc0e9929d14988495e649bb05880e72b74a993f2c5f0868e5a541bd384ed82de4297d17fb76c92ae55cf77016b2fc9027b0fef43e8d612

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
74477448b13fdbecfb2c27a4ede8b342

SHA1
3e06fcd8319de067396f1755f5520de08306874d

SHA256
fca2bc2a0c902cea26135e23fc5ff469ef1c6a5b362e063c092ab13e694fa86e

SHA512
fd4fc1fc2c2f9dd7ce50d3db4db787d5411b85c02a589c74315f8ca7c5dfbe38b0c4a8ee4b61c50d6ee524ff81ff9ccced6daeb061732a41039eafce820e4739

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
c37ebab0cb280d43291d8d4494228f27

SHA1
cd3e822f1b1c432c7f5c01054b2b29577376b270

SHA256
8348953e8f7bbbbef097a093a2d4872d2c585047054815de2d3f53c1f50f5f63

SHA512
d93f980179613d6840ec3f55fd2e6c668dd2f5abe24c674cb439b1ed0026f18dbbceda7243aa8797cbb31eec12280543b28aec4a56623be304baaa18a1f22250

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
ef6de3cd19ee59f8de47cad81dd3688d

SHA1
b25a060494958c7dec1c8e68c65c6c7ab3e21135

SHA256
28d3f11ea0a46913bd7cc1d8d3768bbe6ddfc5481dacab674ecbf610c5764453

SHA512
c6f655640006df27d88bd776aae0142e9098ec058056197b95e7af51c3b01385a5f05a8464247915087bf5efc546edc056697be057a3331fd31665b338112fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
fa3b815376976edf402838fd51b0d6f0

SHA1
a25286323e8c70bd4694e191379a2201f5b43465

SHA256
1c3dfe90ddc9ad29ac91d988bb57fb79aa6211a9b93b113b5a69ff2583a74411

SHA512
36ff59aeb08be72e46abf17fc36e8ba5a99dc1286e377acbc86ac4b867dd013160704b3f73fccfe251f71499b3a70be7945c1d9233725949f0c7fa1d7e8adb50

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
c8d5c06ddcce83ed036705c61ba06102

SHA1
8850587ac16a9ffbab7b84d42a9d98b3a4031e50

SHA256
b765047eb5cd8ae59f0004116adc4832b3bdb33a430f047b0decdd1cc6a506c2

SHA512
f5116e04fc575996aae5d1b051c179362dd820ff7584fbfee21f3a8d0ea6214613c7cfaf495fdbfbc3837b1d73d3b7c76db2bb14054244d2cbc5910e34027e41

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
edffea37e4fb437183b7764aa3e0fb21

SHA1
5d94c87e8e72674dab02bbec4ee1220c705eaad1

SHA256
89aa0c7a63e16c8b1060fb4e973fc9e7b1dee923502f7991f919adfc08713d53

SHA512
47f9bb438c1b279063475709e34ebf505d93db16c14ea10dd265cca715402212f7f626b74d0e0498d0f536089635606f8a9233d6a09128afed06473e7650bdf6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
c9b46d1c66f44a25418593b5923887fb

SHA1
349be68a7f5e0cd06dd1d6770b82f55939661916

SHA256
7844408fb4acf1d988a535e96a46bca6da4bd23b9764e1686b18b63b0b62df5b

SHA512
0b3d785de3b33f142f3706647c657f979c7076d6426cc5e10df04ec341d5445e0b5c1500989d85f1bc0891b50909a9fc1ba8e8573fbb83d8f0e9f9e57f81cb7d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
d54542a4ab46b6db5bf9ac2d7014603f

SHA1
3ec8da19b7b7ba4cc5fea97c51e58b3ac2d82555

SHA256
ed89ef07cb1250796adbc4e8f2a413f3e96efbc37f4bdf997e8c8245069b04d5

SHA512
7117a099a211c971eed52c3b78675fe08716e60a6dfefd31bae0fa965dbe757efdba25db14f942caaf13528725f73ebe0abf125732008eec41e2085a91fc621c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
fa11a768d79c3c50cf09cf6d165eb96e

SHA1
4ec43eec15eec34cf4a1f9a56b11ed4890e2e2ac

SHA256
15515d06d3924380cd92a435f02830e42bede60fc742a813d3c6ce5ee0047388

SHA512
4ee2e2d11018986f69e99d4700030db5b9e72a00c61c47a7efd5a6209d725c5971558514e6e18ef496fbe47490c6544529fbf4c221afde6c176068035ec68099

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
9c16e714ec68d472d5f92b41ffe52208

SHA1
cbb04313cc86a1b0d399d718d6131007ef0f80bd

SHA256
ae0c77bf874385d181722bc2604e2dbc9606cfc446ced384589e02f70161a024

SHA512
e68a84c7bb726f89fb32d7bab4ba90bcd19bc20b8663ba1e3acd07f36385077100c47fb582a74bbd570477bd199dd6e5cffcad2c1ec5ee88a5359382241b01f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
2aef1fa5a1fc7a818aa34bf75860f8c2

SHA1
c3e84a167aa9773293a78d8b2a4c9f2b75e5f18a

SHA256
0d7bafbe3c129962340247326df9c548e439337f804e9c4f8432ab18c5445494

SHA512
230150c06db68c83b8d509eebdc164ec53ec17b5190adbe0e0b07861f0c53310e7d84a8f61027df8813c1019ac641f1e3c865002b2f17c482ead91b9da27464c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b1e5f5619b57bb76a5f6cce5d400189d

SHA1
61c394db76d11a8f067f41fd3f55de7ec4470a71

SHA256
029249d17e6f25ad7fc3c288f48ec3d357bbb154456ed3108e4d178c4503a1da

SHA512
af951c88ed652f28d1f809555c8e276660b6997b17d8ebda1e5b2f380786cb26c9910e063456c210bbb4ea119e24dd596f2edd1283a1282430f72d84ba52010a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
3127f046528c1e7f6ff77cfdd64426e4

SHA1
c2481e5eb1ce3f8f12bf9090bc82549cf3285b5f

SHA256
7a5a0a556d7443590324a524d6a41bcad2a2aa43df760898c4986bbfce05e06b

SHA512
0c24ad362a1d2bebc4dc63c6949e6744ab8d19fcc546aa5f305953c60907fc973f015818e8428197f8788df76ea53f17452743f4cdd8b55c17f7128dad279371

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
d0cb5fae6af48e3f7209c033d78e2695

SHA1
8686f1f897fefba1f0a31d72930747d4b29f46ce

SHA256
3d762062233d5292737ebd881e5b440a7c64672943d405126e0d366f9d514d92

SHA512
b9c800da032dcf78fada4a5e74a74f263d7f362ecf23d5ad95d159fc69c2a4e35fc090431aa4f2951a47ff8fe569e711b45f442a00c407b5e1d6b6563f79f485

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
40359a974a92269078c933bba42bf1c9

SHA1
2d2f2432e6b78aa75fc15e6d95b3596804df2d91

SHA256
399e9d9a09a432f4eda8bbb68439551e01c70bdc0b38c6d22d1354457f45eee2

SHA512
9b4fa79f893076a9c70a3fe402e61d5b9f604a5297623dac21b78ee893c44e593d9bc305d82dbd88b363a15db89cb7a1900265f05ab8bf54d634139c293964a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
678e238e2715731f0b382434a755032d

SHA1
546c2954355a9597d859fba45d29511a9fcae344

SHA256
d345aa3ef87866ca778c03673d4ed59645bcc59403d86657b6a05c87aeb8736c

SHA512
dfd1809e559b4e378ca3d06d73addcc6f759ad3e18a02dbd2a6b89d6a89d5aa0aa74852f95cb7269e00608883e6a3f1d09948ee2e8e58efd49e93facd08c8b3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
9a01167f727764785418ed32a0563e93

SHA1
fc8b7f3a5f8ffeb59811a6a663d0a780dbb2fda8

SHA256
8069e629e7a8fbac91c2053c4e4f9d7b1f9d774084d1a0a218b4eadd598b906a

SHA512
3f1f14e2d424a6bd865d6cf84f0097623d2565045328e5bef4744809b15d9fff2d60561b6aeb325b1d8ef07958d591aaa340c847d8e4e6551388a6bcea19aa4c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
72c3cffb8bb5f7c18f9c5b6d21430a95

SHA1
6fe1abb7aaa4e833989155ddb1c8f90f7322d465

SHA256
5b023f7e09ce971256c70e282cf2d5b94f1b53db5a49ee3cf1ebe5b8454fb053

SHA512
089af751ce43859ffd3f88ff1f41d65f1bd3b1d217bde1374625ddef04e5d2acfb2d5586250655c8f83e2b2118adf817e4f0fb4c1f2cd58e1774e7e964e9540f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
0e08a1a3e370b87975988e98dc542163

SHA1
a332c40e50009d9baf0b9092256dec0d3f77d1f1

SHA256
38cb6a7ea63dd6c00e0efc74c5930a50c69f2d3d6bf7b39890a0dee434c8f7e2

SHA512
70e7c316456986de13aeeeb9c408bd20133a16c188ea4097522c8eba06c31a6fe05c3c1b44c89a866ff73fc4351eb3a425b0051f4abaa089e48483ba4b04bf9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
17a08a8a6b7447f3e3cb69e09b154499

SHA1
dcd9ba000501110f7bef4e76d9e90b267f9ed137

SHA256
d2fe3dcd96ddb6fac6ea8a402425a10a29dd5c7d1a6b458fed766b0aa92779fd

SHA512
1dcf17e9bfbb26fd4d473fe81ab9e414fcfd3c786e8396d5ac4ffc7889deabef6644ff2e945527d4bdf210b48f231c1c7507fe4b5ac715e9e56f39677b5ad552

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
7aae4a230a159fc332bf7ecb4494e25c

SHA1
01b3c1f00e9a683dc0fb4d9913733baf88c23dd8

SHA256
128f5d6d238e93a1bf3fd299514d64caca759401d9dea7573e1160cbd863957b

SHA512
00a2726de3b7e972f3767450ae518dc7ed87544dca2e5b44f859cbbd56aa3da7ff5d56ddf60acf40c82f3380fc4d1925c24f70bc1e59e1fc06b6acdd8f5c0a49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
b9c2171f5a1b80a05768a46c5b2eaed3

SHA1
2397d3d75d0a090c3653ceada70249c048d767e1

SHA256
db1082a71a062b301372cfefdf54c65881d563f748d56dfab04c038822b445c9

SHA512
d1700bd18897ff5e2fd0d0e68f7f4c213147d650c62a489b04525ccf6cbcb33800921463de407b582be95b359ad93661ad4f56bdd71973f9621f4e71c24ee4b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
364d00e06ad7ca212af986085b349ac1

SHA1
a31972b5531862d652bcba745baf2c6a2aeda1a8

SHA256
94db6c47cdad4d25a0080c4863d20b10321438fd70c5f73df5ecf231d6f21514

SHA512
8e29436f17a5d76aa19238761085bfb6b55c7c997fa5edc55b79d8ad4c78901f30f1ed72bdaf49819ea4e834937d29c41a24a3dc9a6f79b05e5eaab0d3ef5e24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
f1b2d1eb1c8def9b95db389df2c3806a

SHA1
4a260584ba3ca14dd9b12b2c0a7b90b7cc573708

SHA256
ea2cb217f8934e587e46b5f04ae4df76278ebb8bfe72787a96df30a675fb8eee

SHA512
72941f9df7ef84aaf1ef8d9bcaaa73faf8b385c7c9cbd9e9b2b12b42da621dae9fa938d80f460e79b5ac5b70583ad999f84259bdb28d2a0769b4fe056962dfa7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
ecb162bad581b1bef06157bbb4955373

SHA1
29d4762cfc2c981da103ccc127d82b1b1020ae96

SHA256
770a8f0e3068850ddaa23b1c37209b7c32b1f7f56e0234512db14e02f43cdf90

SHA512
8e302c2185e70512d0b59fc2f97d5d3f5ecdc99c66a8abbf46b7dc0255cd5c2d5eb4268ad38c10d3f527586ea5be0a0d228ad11dbc9c14c28b1ba06da67c0ea7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
3ecceca28fa709a215d887911f26335e

SHA1
eb28ec1107571d5f2b39dc3a13202039862aa8cf

SHA256
c4e1211ab956dd352cc6cc411e4579da85b4ecddedf12668b329a0655bfea242

SHA512
1da864adb8e518e1f74d64c1c80c37b258c10a0d7366ac61ae00115eafa4bc337b0e033a5de2b7317e07e6267d14b9d99e6d33aec84bb395be6a6da11d13f509

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
05720148d0a04bf574814d55892eadd2

SHA1
54e60bcf84af92b1d4a633f9974a2f1edff592fc

SHA256
440f0e4154094e75e493df3f5dac4f4c63681d6b4f335677b3f4ebd859ffc91b

SHA512
3cfc5a3b27e891c91a4e8bafe84b1d8ec1172433d4353b0d6858bab92f524c31fd152c6b3942df952118117affd273c557f9675a5b80d3f0dd14b55d43eace6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
4fdb73a68581a381a6a35568089e85d4

SHA1
95ff979943ddad48b8cb71468fcab1f4824eac81

SHA256
9913d0215ae3adc99892c6bbee78769e8c9bea107ebcc90c4df7abdd4f23cfbd

SHA512
af62030abe2855a99145407fb17867c910f153d07bd9b08a59957f26b9ca31043285227cb9735a39e99e9c23ac4b1a24fc0ff544cff2b17ec78d8d6c7e2d7c68

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6AWE8D637TEDHJ4WLDUE.temp

Filesize
6KB

MD5
ef62aacaddcfb72952f3395116ab37d4

SHA1
e6410d15dbc2724c6c6b600239c2a7c2c981465f

SHA256
8931130f993b480dad3f9f4a27db650760ca5a43fd2ab2b9c0608807392a7d49

SHA512
fa84ae77e059fcddc77083b7733e00d6d6859f1af5b72e8abe68f0d8739bc89d3ab2385d0c1082c5cae8cf8005bee8704c4a0c189bc151c01cd4abcde684122c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U7TVXJH55IEACZ22PDEJ.temp

Filesize
6KB

MD5
fd417560c8e68c97931ca529420b4dc7

SHA1
1cddb4d1e19570c2e63095f67b570774224f2b3d

SHA256
279e5dccf348c360e6b2ad934417e827f045556660f70e9d5b8c059fa677bbac

SHA512
696cd49d535b7a7ffd0022dc896421b698b5fdf57f5f144c4dbb20584d92029916f024bb80814f39b8d57314703398957c9800a31e47c05862261d416b4c7fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U8RQTY6ZV697I2KG1ZK2.temp

Filesize
6KB

MD5
d9f5e2767ad11afc26c837a53450ddc2

SHA1
5a2e95c936abbb7c859eb80ff1f32caeffb571c5

SHA256
405258d68e6ecb002792017f2641eaa48111ab0480fbe644d778ad7d31c0af0e

SHA512
43972d30b92a44d69f61fcddf4663cf734555fcc42fbc055124852d6c2bfe7d19f826f1020ae8f52d99ec01920917881f55c31a8669fd99aa546870f68264389

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WinTask\$77Runtime Broker.exe

Filesize
45KB

MD5
1cf8d6e0acaa084d9b4201f11a1a04a8

SHA1
7cc576ff7a096e14a6e83836bfd3cd29f7164392

SHA256
c7c78f431c21c05d2963fb7635b73d969b7dada294252ef1d2b634b030a2375f

SHA512
de6889cffba397b9a95b02d3271b14c9abbe543fb2a4415182cb24e9a3cf152bfb1ae5d3237eacac613f411fc278d120191f45c5cb1c4ca5135f393b57c0527a

Download Submit
memory/684-22-0x0000024B23830000-0x0000024B23852000-memory.dmp

Filesize
136KB

Download
memory/1496-10-0x00007FFB801F0000-0x00007FFB80CB2000-memory.dmp

Filesize
10.8MB

Download
memory/1496-4-0x00007FFB801F0000-0x00007FFB80CB2000-memory.dmp

Filesize
10.8MB

Download
memory/1496-3-0x00007FFB801F3000-0x00007FFB801F5000-memory.dmp

Filesize
8KB

Download
memory/1496-2-0x00007FFB801F0000-0x00007FFB80CB2000-memory.dmp

Filesize
10.8MB

Download
memory/1496-0-0x00007FFB801F3000-0x00007FFB801F5000-memory.dmp

Filesize
8KB

Download
memory/1496-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2040-27-0x0000000001160000-0x0000000001170000-memory.dmp

Filesize
64KB

Download
memory/2040-29-0x0000000001620000-0x0000000001640000-memory.dmp

Filesize
128KB

Download
memory/2040-28-0x0000000001600000-0x0000000001622000-memory.dmp

Filesize
136KB

Download
memory/4796-92-0x000001F1FF9C0000-0x000001F1FFA06000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads