rms | a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
13-02-2022 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe
Size

11.9MB
MD5

dcbe4706bb4880c407588a0a1b16d7a5
SHA1

d621fc9854d5ff3a012554378e8c5b77f7761a9f
SHA256

a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753
SHA512

6053783ad26ae8d9bdbb2cea609d910c321c012ebaf875f3c18b418e282ace385ef86753ad40391cc132a64b8fabd180edf6cbafb94b784883646a9d708734fb

Score

10^/10

rms evasion persistence rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001e86d-137.dat	acprotect
behavioral2/files/0x000500000001e8b9-154.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4876	data.exe
4596	TorAd.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001e86d-137.dat	upx
behavioral2/files/0x000500000001e8b9-154.dat	upx

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	data.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Services = "C:Tor\\TorAd.exe"	reg.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File created	C:\Windows\4w5tb68h7t987093f4trq893f4rw89etw.txt	wscript.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
664	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
2532	tasklist.exe
3576	tasklist.exe
732	tasklist.exe
2320	tasklist.exe
4336	tasklist.exe
2324	tasklist.exe
828	tasklist.exe
4092	tasklist.exe
1836	tasklist.exe
1096	tasklist.exe
4948	tasklist.exe
3604	tasklist.exe
4244	tasklist.exe
5092	tasklist.exe
2284	tasklist.exe
4444	tasklist.exe
2648	tasklist.exe
1832	tasklist.exe
2400	tasklist.exe
4700	tasklist.exe
4332	tasklist.exe
4176	tasklist.exe
3924	tasklist.exe
4924	tasklist.exe
664	tasklist.exe
3396	tasklist.exe
4264	tasklist.exe
4812	tasklist.exe
1320	tasklist.exe
1840	tasklist.exe
4732	tasklist.exe
4156	tasklist.exe
4456	tasklist.exe
1476	tasklist.exe
2368	tasklist.exe
2084	tasklist.exe
1404	tasklist.exe
4564	tasklist.exe
5076	tasklist.exe
4808	tasklist.exe
4252	tasklist.exe
740	tasklist.exe
912	tasklist.exe
2180	tasklist.exe
3636	tasklist.exe
4160	tasklist.exe
3932	tasklist.exe
2580	tasklist.exe
4992	tasklist.exe
1112	tasklist.exe
4360	tasklist.exe
4216	tasklist.exe
4960	tasklist.exe
4300	tasklist.exe
4720	tasklist.exe
4160	tasklist.exe
4252	tasklist.exe
860	tasklist.exe
1988	tasklist.exe
4160	tasklist.exe
560	tasklist.exe
4764	tasklist.exe
2440	tasklist.exe
2068	tasklist.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	data.exe
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2472	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1340	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	TorAd.exe
4596	TorAd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4596	TorAd.exe
Token: SeTcbPrivilege	4596	TorAd.exe
Token: SeTcbPrivilege	4596	TorAd.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeShutdownPrivilege	1600	svchost.exe
Token: SeCreatePagefilePrivilege	1600	svchost.exe
Token: SeShutdownPrivilege	1600	svchost.exe
Token: SeCreatePagefilePrivilege	1600	svchost.exe
Token: SeShutdownPrivilege	1600	svchost.exe
Token: SeCreatePagefilePrivilege	1600	svchost.exe
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	4368	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	3088	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	2068	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	4700	tasklist.exe
Token: SeDebugPrivilege	4156	tasklist.exe
Token: SeDebugPrivilege	4252	tasklist.exe
Token: SeDebugPrivilege	4160	tasklist.exe
Token: SeDebugPrivilege	988	tasklist.exe
Token: SeDebugPrivilege	4940	tasklist.exe
Token: SeDebugPrivilege	1976	tasklist.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	4836	tasklist.exe
Token: SeDebugPrivilege	3368	tasklist.exe
Token: SeDebugPrivilege	4152	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	912	tasklist.exe
Token: SeDebugPrivilege	3372	tasklist.exe
Token: SeDebugPrivilege	2456	tasklist.exe
Token: SeDebugPrivilege	852	tasklist.exe
Token: SeDebugPrivilege	2368	tasklist.exe
Token: SeDebugPrivilege	3492	tasklist.exe
Token: SeDebugPrivilege	4460	tasklist.exe
Token: SeDebugPrivilege	4448	tasklist.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeDebugPrivilege	1892	tasklist.exe
Token: SeDebugPrivilege	1096	tasklist.exe
Token: SeDebugPrivilege	4380	tasklist.exe
Token: SeSecurityPrivilege	4940	TiWorker.exe
Token: SeRestorePrivilege	4940	TiWorker.exe
Token: SeBackupPrivilege	4940	TiWorker.exe
Token: SeDebugPrivilege	2160	tasklist.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	512	tasklist.exe
Token: SeDebugPrivilege	4804	tasklist.exe
Token: SeDebugPrivilege	3732	tasklist.exe
Token: SeDebugPrivilege	3088	tasklist.exe
Token: SeDebugPrivilege	3188	tasklist.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeDebugPrivilege	1836	tasklist.exe
Token: SeDebugPrivilege	3248	tasklist.exe
Token: SeBackupPrivilege	4940	TiWorker.exe
Token: SeRestorePrivilege	4940	TiWorker.exe
Token: SeSecurityPrivilege	4940	TiWorker.exe
Token: SeBackupPrivilege	4940	TiWorker.exe
Token: SeRestorePrivilege	4940	TiWorker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4596	TorAd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4876	5016	a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe	83
PID 5016 wrote to memory of 4876	5016	a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe	83
PID 5016 wrote to memory of 4876	5016	a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe	83
PID 4876 wrote to memory of 2440	4876	data.exe	85
PID 4876 wrote to memory of 2440	4876	data.exe	85
PID 4876 wrote to memory of 2440	4876	data.exe	85
PID 2440 wrote to memory of 1908	2440	WScript.exe	86
PID 2440 wrote to memory of 1908	2440	WScript.exe	86
PID 2440 wrote to memory of 1908	2440	WScript.exe	86
PID 2440 wrote to memory of 2676	2440	WScript.exe	87
PID 2440 wrote to memory of 2676	2440	WScript.exe	87
PID 2440 wrote to memory of 2676	2440	WScript.exe	87
PID 2440 wrote to memory of 3416	2440	WScript.exe	88
PID 2440 wrote to memory of 3416	2440	WScript.exe	88
PID 2440 wrote to memory of 3416	2440	WScript.exe	88
PID 2440 wrote to memory of 2068	2440	WScript.exe	89
PID 2440 wrote to memory of 2068	2440	WScript.exe	89
PID 2440 wrote to memory of 2068	2440	WScript.exe	89
PID 2440 wrote to memory of 2924	2440	WScript.exe	90
PID 2440 wrote to memory of 2924	2440	WScript.exe	90
PID 2440 wrote to memory of 2924	2440	WScript.exe	90
PID 1908 wrote to memory of 3392	1908	wscript.exe	91
PID 1908 wrote to memory of 3392	1908	wscript.exe	91
PID 1908 wrote to memory of 3392	1908	wscript.exe	91
PID 3392 wrote to memory of 3976	3392	cmd.exe	93
PID 3392 wrote to memory of 3976	3392	cmd.exe	93
PID 3392 wrote to memory of 3976	3392	cmd.exe	93
PID 3392 wrote to memory of 224	3392	cmd.exe	94
PID 3392 wrote to memory of 224	3392	cmd.exe	94
PID 3392 wrote to memory of 224	3392	cmd.exe	94
PID 3392 wrote to memory of 4468	3392	cmd.exe	95
PID 3392 wrote to memory of 4468	3392	cmd.exe	95
PID 3392 wrote to memory of 4468	3392	cmd.exe	95
PID 3392 wrote to memory of 4480	3392	cmd.exe	96
PID 3392 wrote to memory of 4480	3392	cmd.exe	96
PID 3392 wrote to memory of 4480	3392	cmd.exe	96
PID 3392 wrote to memory of 4448	3392	cmd.exe	97
PID 3392 wrote to memory of 4448	3392	cmd.exe	97
PID 3392 wrote to memory of 4448	3392	cmd.exe	97
PID 3392 wrote to memory of 4944	3392	cmd.exe	98
PID 3392 wrote to memory of 4944	3392	cmd.exe	98
PID 3392 wrote to memory of 4944	3392	cmd.exe	98
PID 3392 wrote to memory of 1340	3392	cmd.exe	99
PID 3392 wrote to memory of 1340	3392	cmd.exe	99
PID 3392 wrote to memory of 1340	3392	cmd.exe	99
PID 3392 wrote to memory of 664	3392	cmd.exe	100
PID 3392 wrote to memory of 664	3392	cmd.exe	100
PID 3392 wrote to memory of 664	3392	cmd.exe	100
PID 3392 wrote to memory of 4596	3392	cmd.exe	101
PID 3392 wrote to memory of 4596	3392	cmd.exe	101
PID 3392 wrote to memory of 4596	3392	cmd.exe	101
PID 3392 wrote to memory of 532	3392	cmd.exe	102
PID 3392 wrote to memory of 532	3392	cmd.exe	102
PID 3392 wrote to memory of 532	3392	cmd.exe	102
PID 3392 wrote to memory of 1288	3392	cmd.exe	103
PID 3392 wrote to memory of 1288	3392	cmd.exe	103
PID 3392 wrote to memory of 1288	3392	cmd.exe	103
PID 3392 wrote to memory of 1864	3392	cmd.exe	104
PID 3392 wrote to memory of 1864	3392	cmd.exe	104
PID 3392 wrote to memory of 1864	3392	cmd.exe	104
PID 3392 wrote to memory of 2160	3392	cmd.exe	106
PID 3392 wrote to memory of 2160	3392	cmd.exe	106
PID 3392 wrote to memory of 2160	3392	cmd.exe	106
PID 3392 wrote to memory of 1796	3392	cmd.exe	107

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3976	attrib.exe
1288	attrib.exe
1864	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe
"C:\Users\Admin\AppData\Local\Temp\a8e1451977681daed17a51989b03247d068e677a1ef9513b112fc1f968227753.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe" -p284579G45398T745398T
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      Checks computer location settings
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Log\Windows\hiscomponent\install.bat" "
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3392
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Log"
        6⤵
        Views/modifies file attributes
        
        PID:3976
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        
        PID:224
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Log\Windows\hiscomponent\msg.vbs"
        6⤵
        
        PID:4468
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        6⤵
        
        PID:4480
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f
        6⤵
        
        PID:4448
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f
        6⤵
        
        PID:4944
      - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "Windows\hiscomponent\regedit.reg"
        6⤵
        Runs .reg file with regedit
        
        PID:1340
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:664
      - C:\Tor\TorAd.exe
        
        TorAd.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4596
      - C:\Windows\SysWOW64\reg.exe
        
        Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Services" /t REG_SZ /d "C:Tor\TorAd.exe" /f
        6⤵
        Adds Run key to start application
        
        PID:532
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Tor\*.*"
        6⤵
        Views/modifies file attributes
        
        PID:1288
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Tor"
        6⤵
        Views/modifies file attributes
        
        PID:1864
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Tor\process.vbs"
        6⤵
        Checks computer location settings
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Tor\process.bat" "
        7⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:912
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4156
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4836
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:852
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:512
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4804
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3248
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4924
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:476
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:544
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:636
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2180
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:920
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:912
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:228
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:532
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2532
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:5076
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1096
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:512
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3576
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:912
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1476
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:224
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:664
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4948
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4332
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:912
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2368
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:664
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3636
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4264
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:456
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:732
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2084
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4812
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:228
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:636
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4176
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:912
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2320
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4252
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:444
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1320
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:384
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1840
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:544
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:444
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:456
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4808
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:860
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:392
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3604
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4732
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3924
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:620
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:860
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4216
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:624
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:224
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:228
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3396
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:764
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:220
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4336
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:624
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2324
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4960
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:544
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:636
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1404
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4564
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:456
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:728
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3932
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:828
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2648
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:804
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4360
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4156
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:532
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:732
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4244
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4300
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:480
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:64
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2440
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:664
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1832
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:5092
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4252
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:636
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2284
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4444
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:740
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:620
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:220
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2580
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:528
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:116
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:560
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:384
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:828
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:632
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:912
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:756
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:636
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4764
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:456
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:860
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:4456
        
        C:\Windows\SysWOW64\find.exe
        
        find "TorAd.exe"
        8⤵
        
        PID:3084
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:2472
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      PID:2676
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      PID:3416
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-157-0x0000027A42B50000-0x0000027A42B60000-memory.dmp

Filesize
64KB

Download
memory/1600-158-0x0000027A433E0000-0x0000027A433F0000-memory.dmp

Filesize
64KB

Download
memory/1600-159-0x0000027A458D0000-0x0000027A458D4000-memory.dmp

Filesize
16KB

Download
memory/4596-156-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download