Analysis
-
max time kernel
90s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
30-10-2022 17:57
General
-
Target
17bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9.exe
-
Size
512KB
-
MD5
82fd0018bb2441cfc589124168472840
-
SHA1
c389e4cd7981f7236f19f357f5ba61901d52dc37
-
SHA256
17bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9
-
SHA512
bbe2e63c6e60ef81492458589b0f828fae7790d0ef3b8d9719ea7cf392f0e0da7034ac3c0662273513954d2979181cb31d2cba74a42736505aafaa26d3ab12ff
-
SSDEEP
6144:0c47HpZ9ELuQN28GWqDfKCmxS1h8sF5/x:jKpcLuQpgDf+xKh8Kp
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs 4 IoCs
-
Executes dropped EXE 3 IoCs
-
Possible privilege escalation attempt 64 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Modifies file permissions 1 TTPs 64 IoCs
-
Checks whether UAC is enabled 1 TTPs 8 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9.exe"C:\Users\Admin\AppData\Local\Temp\17bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exe"C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exe" -2⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exe"C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exe" -3⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\arh.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\arh.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Eula.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Eula.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\reader_sl.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\reader_sl.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\wow_helper.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\wow_helper.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARM.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Java\Java Update\jaureg.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Java\Java Update\jaureg.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Java\Java Update\jucheck.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Java\Java Update\jucheck.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Java\Java Update\jusched.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Java\Java Update\jusched.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\pipanel.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\pipanel.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\TabTip32.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\TabTip32.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"4⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\MSInfo\msinfo32.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler64.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler64.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdate.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdate.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateBroker.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateBroker.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateCore.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateCore.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateSetup.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateSetup.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\DisabledGoogleUpdate.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\DisabledGoogleUpdate.exe"4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\chrome_installer.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\chrome_installer.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\ExtExport.exe"4⤵
- Possible privilege escalation attempt
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\ExtExport.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\ieinstal.exe"4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\ieinstal.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\ielowutil.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\ielowutil.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\iexplore.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\iexplore.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe"4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe" /grant Admin:D4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge_proxy.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge_proxy.exe" /grant Admin:D4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\pwahelper.exe"4⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\pwahelper.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeComRegisterShellARM64.exe"4⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeComRegisterShellARM64.exe" /grant Admin:D4⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\arh.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\arh.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Eula.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\Eula.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\reader_sl.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\reader_sl.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\wow_helper.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Adobe\Acrobat Reader DC\Reader\wow_helper.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARM.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Java\Java Update\jaureg.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Java\Java Update\jaureg.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Java\Java Update\jucheck.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Java\Java Update\jucheck.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Java\Java Update\jusched.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Java\Java Update\jusched.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\pipanel.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\pipanel.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\TabTip32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\ink\TabTip32.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\MSInfo\msinfo32.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler64.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleCrashHandler64.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdate.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdate.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateBroker.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateBroker.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateCore.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateCore.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateSetup.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\1.3.36.71\GoogleUpdateSetup.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\DisabledGoogleUpdate.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\DisabledGoogleUpdate.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\chrome_installer.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Google\Update\Install\{0D3B55D5-C891-4ABD-ADA8-7B4746A87555}\chrome_installer.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\ExtExport.exe"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\ExtExport.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\ieinstal.exe"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\ieinstal.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\ielowutil.exe"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\ielowutil.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Internet Explorer\iexplore.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Internet Explorer\iexplore.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe"3⤵
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe" /grant Admin:D3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge_proxy.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\msedge_proxy.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\Edge\Application\pwahelper.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\Edge\Application\pwahelper.exe" /grant Admin:D3⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Program Files (x86)\\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeComRegisterShellARM64.exe"3⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeComRegisterShellARM64.exe" /grant Admin:D3⤵
- Possible privilege escalation attempt
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exe"C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exe" -2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50ead72f8a7146873391c71824000c5e1
SHA120be145404007b2033768096ac43ebbc29c526fd
SHA25624235497339896f27985465ada8c25c37e989bd12faac5dec00c1b09cf2a0373
SHA5121cefc50907547470e8572a28e24fa48c6eeac10c03e57fe334d9674673d2667a6c0a0299545d74f25e1b9a66641f5391cfd7c255550e45933df03b7b30017513
-
C:\Program Files (x86)\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50f2dfe0f3377a5fbc35ea259522b3b3c
SHA1251591bcba6f2120e07a7e77c5023a586240376a
SHA2566b9010cb7b02e450a97484800e14ea03d0a1de411aade46e43e8dd6708f803fc
SHA5127795b5bad85505875cff7b9bc0f691e6e1679716dd850bb9947bb0e6b0af81881e9caaf0895b4b8e34c2fdc0d5fb736817bdc2a1f0782671b3fe8ea7f5a2083f
-
C:\Program Files (x86)\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Program Files (x86)\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exeFilesize
512KB
MD582fd0018bb2441cfc589124168472840
SHA1c389e4cd7981f7236f19f357f5ba61901d52dc37
SHA25617bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9
SHA512bbe2e63c6e60ef81492458589b0f828fae7790d0ef3b8d9719ea7cf392f0e0da7034ac3c0662273513954d2979181cb31d2cba74a42736505aafaa26d3ab12ff
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exeFilesize
512KB
MD582fd0018bb2441cfc589124168472840
SHA1c389e4cd7981f7236f19f357f5ba61901d52dc37
SHA25617bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9
SHA512bbe2e63c6e60ef81492458589b0f828fae7790d0ef3b8d9719ea7cf392f0e0da7034ac3c0662273513954d2979181cb31d2cba74a42736505aafaa26d3ab12ff
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exeFilesize
512KB
MD582fd0018bb2441cfc589124168472840
SHA1c389e4cd7981f7236f19f357f5ba61901d52dc37
SHA25617bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9
SHA512bbe2e63c6e60ef81492458589b0f828fae7790d0ef3b8d9719ea7cf392f0e0da7034ac3c0662273513954d2979181cb31d2cba74a42736505aafaa26d3ab12ff
-
C:\Users\Admin\AppData\Local\Temp\ahnbpqiqvi.exeFilesize
512KB
MD582fd0018bb2441cfc589124168472840
SHA1c389e4cd7981f7236f19f357f5ba61901d52dc37
SHA25617bffdc7caa0f9f12900cbcdb322880c952cd1b39039db00b04e32af77169fd9
SHA512bbe2e63c6e60ef81492458589b0f828fae7790d0ef3b8d9719ea7cf392f0e0da7034ac3c0662273513954d2979181cb31d2cba74a42736505aafaa26d3ab12ff
-
C:\Users\Admin\AppData\Local\Temp\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50ead72f8a7146873391c71824000c5e1
SHA120be145404007b2033768096ac43ebbc29c526fd
SHA25624235497339896f27985465ada8c25c37e989bd12faac5dec00c1b09cf2a0373
SHA5121cefc50907547470e8572a28e24fa48c6eeac10c03e57fe334d9674673d2667a6c0a0299545d74f25e1b9a66641f5391cfd7c255550e45933df03b7b30017513
-
C:\Users\Admin\AppData\Local\Temp\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50f2dfe0f3377a5fbc35ea259522b3b3c
SHA1251591bcba6f2120e07a7e77c5023a586240376a
SHA2566b9010cb7b02e450a97484800e14ea03d0a1de411aade46e43e8dd6708f803fc
SHA5127795b5bad85505875cff7b9bc0f691e6e1679716dd850bb9947bb0e6b0af81881e9caaf0895b4b8e34c2fdc0d5fb736817bdc2a1f0782671b3fe8ea7f5a2083f
-
C:\Users\Admin\AppData\Local\Temp\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Users\Admin\AppData\Local\Temp\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Users\Admin\AppData\Local\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50ead72f8a7146873391c71824000c5e1
SHA120be145404007b2033768096ac43ebbc29c526fd
SHA25624235497339896f27985465ada8c25c37e989bd12faac5dec00c1b09cf2a0373
SHA5121cefc50907547470e8572a28e24fa48c6eeac10c03e57fe334d9674673d2667a6c0a0299545d74f25e1b9a66641f5391cfd7c255550e45933df03b7b30017513
-
C:\Users\Admin\AppData\Local\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Users\Admin\AppData\Local\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Users\Admin\AppData\Local\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Windows\SysWOW64\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50ead72f8a7146873391c71824000c5e1
SHA120be145404007b2033768096ac43ebbc29c526fd
SHA25624235497339896f27985465ada8c25c37e989bd12faac5dec00c1b09cf2a0373
SHA5121cefc50907547470e8572a28e24fa48c6eeac10c03e57fe334d9674673d2667a6c0a0299545d74f25e1b9a66641f5391cfd7c255550e45933df03b7b30017513
-
C:\Windows\SysWOW64\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50f2dfe0f3377a5fbc35ea259522b3b3c
SHA1251591bcba6f2120e07a7e77c5023a586240376a
SHA2566b9010cb7b02e450a97484800e14ea03d0a1de411aade46e43e8dd6708f803fc
SHA5127795b5bad85505875cff7b9bc0f691e6e1679716dd850bb9947bb0e6b0af81881e9caaf0895b4b8e34c2fdc0d5fb736817bdc2a1f0782671b3fe8ea7f5a2083f
-
C:\Windows\SysWOW64\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Windows\SysWOW64\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Windows\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD50ead72f8a7146873391c71824000c5e1
SHA120be145404007b2033768096ac43ebbc29c526fd
SHA25624235497339896f27985465ada8c25c37e989bd12faac5dec00c1b09cf2a0373
SHA5121cefc50907547470e8572a28e24fa48c6eeac10c03e57fe334d9674673d2667a6c0a0299545d74f25e1b9a66641f5391cfd7c255550e45933df03b7b30017513
-
C:\Windows\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Windows\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
C:\Windows\ihflrkuurwwunxnhvhsrpvbu.ebgFilesize
32B
MD54128509cbca080cd31519ceed504d1c8
SHA1dc874088758a3821282fa5a9ae00fd0e368409e0
SHA256f04355788e59f454ab02bf1dd57fd5d08ef9bff09c6326aaf1ba65223579f4bc
SHA5128b7c98a67b31c35f1edb6591dccf73f0d3dd2283412ccefad3d1a446b426c1b9254e3953f47f39038021a71eadfda0f08e5d6d69c8785266dff33a337b57e458
-
memory/116-201-0x0000000000000000-mapping.dmp
-
memory/812-204-0x0000000000000000-mapping.dmp
-
memory/1064-163-0x0000000000000000-mapping.dmp
-
memory/1084-210-0x0000000000000000-mapping.dmp
-
memory/1084-183-0x0000000000000000-mapping.dmp
-
memory/1228-168-0x0000000000000000-mapping.dmp
-
memory/1300-175-0x0000000000000000-mapping.dmp
-
memory/1300-202-0x0000000000000000-mapping.dmp
-
memory/1312-217-0x0000000000000000-mapping.dmp
-
memory/1408-159-0x0000000000000000-mapping.dmp
-
memory/1456-166-0x0000000000000000-mapping.dmp
-
memory/1484-169-0x0000000000000000-mapping.dmp
-
memory/1600-213-0x0000000000000000-mapping.dmp
-
memory/1604-214-0x0000000000000000-mapping.dmp
-
memory/1604-162-0x0000000000000000-mapping.dmp
-
memory/1608-199-0x0000000000000000-mapping.dmp
-
memory/1812-218-0x0000000000000000-mapping.dmp
-
memory/1848-188-0x0000000000000000-mapping.dmp
-
memory/1892-170-0x0000000000000000-mapping.dmp
-
memory/1948-165-0x0000000000000000-mapping.dmp
-
memory/1960-182-0x0000000000000000-mapping.dmp
-
memory/1996-212-0x0000000000000000-mapping.dmp
-
memory/2248-135-0x0000000000000000-mapping.dmp
-
memory/2360-206-0x0000000000000000-mapping.dmp
-
memory/2368-185-0x0000000000000000-mapping.dmp
-
memory/2420-198-0x0000000000000000-mapping.dmp
-
memory/2424-215-0x0000000000000000-mapping.dmp
-
memory/2640-132-0x0000000000000000-mapping.dmp
-
memory/2668-178-0x0000000000000000-mapping.dmp
-
memory/2756-171-0x0000000000000000-mapping.dmp
-
memory/2764-197-0x0000000000000000-mapping.dmp
-
memory/2876-207-0x0000000000000000-mapping.dmp
-
memory/2964-195-0x0000000000000000-mapping.dmp
-
memory/3008-189-0x0000000000000000-mapping.dmp
-
memory/3012-208-0x0000000000000000-mapping.dmp
-
memory/3012-181-0x0000000000000000-mapping.dmp
-
memory/3032-161-0x0000000000000000-mapping.dmp
-
memory/3340-190-0x0000000000000000-mapping.dmp
-
memory/3364-205-0x0000000000000000-mapping.dmp
-
memory/3588-179-0x0000000000000000-mapping.dmp
-
memory/3648-174-0x0000000000000000-mapping.dmp
-
memory/3672-203-0x0000000000000000-mapping.dmp
-
memory/3712-176-0x0000000000000000-mapping.dmp
-
memory/3744-152-0x0000000000000000-mapping.dmp
-
memory/3768-172-0x0000000000000000-mapping.dmp
-
memory/3904-173-0x0000000000000000-mapping.dmp
-
memory/3988-186-0x0000000000000000-mapping.dmp
-
memory/4036-177-0x0000000000000000-mapping.dmp
-
memory/4080-160-0x0000000000000000-mapping.dmp
-
memory/4124-187-0x0000000000000000-mapping.dmp
-
memory/4244-209-0x0000000000000000-mapping.dmp
-
memory/4260-191-0x0000000000000000-mapping.dmp
-
memory/4260-219-0x0000000000000000-mapping.dmp
-
memory/4276-184-0x0000000000000000-mapping.dmp
-
memory/4328-211-0x0000000000000000-mapping.dmp
-
memory/4464-192-0x0000000000000000-mapping.dmp
-
memory/4556-164-0x0000000000000000-mapping.dmp
-
memory/4580-180-0x0000000000000000-mapping.dmp
-
memory/4600-216-0x0000000000000000-mapping.dmp
-
memory/4712-167-0x0000000000000000-mapping.dmp
-
memory/4944-196-0x0000000000000000-mapping.dmp
-
memory/5012-193-0x0000000000000000-mapping.dmp
-
memory/5092-194-0x0000000000000000-mapping.dmp
-
memory/5108-200-0x0000000000000000-mapping.dmp