blacknet | deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025

Analysis

max time kernel
180s
max time network
210s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe
Size

1.8MB
MD5

f1fa7d91c9d5c31b8dcb25fa73a1fad3
SHA1

a60fef98fb8dd848fbf57374fd2f70569950fd06
SHA256

deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025
SHA512

3cd56c54248b9363424bf447fd5c92bcfc6970d6ba6bf78e92abaf246c4631a8f77a7d69f9d3bd6af99d0ccbfa6490bff556d9973a10bca0ca090c40f1dc6703
SSDEEP

24576:3LKvy63ol0CibUBc6S4RBv6JhDW+baR5n9dV83mNO+b5j5ZmDQG5+a:3Ll63C0h6dXvSdaR93V83eljG

Score

10^/10

blacknet njrat remcos bot client host evasion persistence rat trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Client

dontreachme3.ddns.net:3604

Mutex

EdgeBrowser.exe

Attributes

reg_key
EdgeBrowser.exe
splitter
123

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

dontreachme3.ddns.net:3605

dontreachme1.ddns.net:3605

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
explorer.exe
copy_folder
explorer
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%SystemDrive%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
RuntimeBroker
keylog_path
%AppData%
mouse_option
true
mutex
remcos_ekuntpjjaa
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
RuntimeBroker
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

Bot

https://furyx.de/panel

Mutex

BN[e5decf896675e5ecc7bbef8ebff8a786]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
50651597687556f33b7fc75d90350b99
startup
false
usb_spread
true

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2596-274-0x000000000041768E-mapping.dmp	family_blacknet
behavioral1/memory/2596-280-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2596-274-0x000000000041768E-mapping.dmp	disable_win_def
behavioral1/memory/2596-280-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

WinExplorer.exeEdgeBrowser.exeFirefoxinstaller.exeWindowsExplorer.exeexplorer.exerealtekaudio.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\Documents\\WinExplorer.exe\""	WinExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\Documents\\EdgeBrowser.exe\""	EdgeBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\Documents\\Firefoxinstaller.exe\""	Firefoxinstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\explorer\\explorer.exe\""	WindowsExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\explorer\\explorer.exe\""	WindowsExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\explorer\\explorer.exe\""	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\explorer\\explorer.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\realtekaudio.exe\""	realtekaudio.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

WinExplorer.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	WinExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	WinExplorer.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exeWD+UAC.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WD+UAC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Windows security bypass 2 TTPs 9 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

realtekaudio.exerealtekaudio.exeEdgeBrowser.exeWinExplorer.exeFirefoxinstaller.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe = "0"	realtekaudio.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\realtekaudio.exe = "0"	realtekaudio.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\WinExplorer.exe = "0"	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\Firefoxinstaller.exe = "0"	Firefoxinstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\EdgeBrowser.exe = "0"	EdgeBrowser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe = "0"	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe = "0"	Firefoxinstaller.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WindowsExplorer.exeexplorer.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WindowsExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RuntimeBroker = "\"C:\\explorer\\explorer.exe\""	WindowsExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RuntimeBroker = "\"C:\\explorer\\explorer.exe\""	explorer.exe

Drops file in Drivers directory 1 IoCs

Processes:

EasyAASM.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	EasyAASM.exe

Executes dropped EXE 18 IoCs

Processes:

tmp429D.tmp.exetmp42EC.tmp.exeWD+UAC.exeMicrosoftCompatibility Download.exeEasyAASM.exeFirefoxinstaller.exeNortonInstaller.exeWinExplorer.exeEdgeBrowser.exeEdgeBrowser.exeWinExplorer.exeWindowsExplorer.exeFirefoxinstaller.exeFirefoxinstaller.exeexplorer.exeEdgeBrowser.exerealtekaudio.exerealtekaudio.exe

pid	Process
1052	tmp429D.tmp.exe
764	tmp42EC.tmp.exe
1624	WD+UAC.exe
760	MicrosoftCompatibility Download.exe
772	EasyAASM.exe
1872	Firefoxinstaller.exe
1448	NortonInstaller.exe
1936	WinExplorer.exe
748	EdgeBrowser.exe
2864	EdgeBrowser.exe
2856	WinExplorer.exe
2804	WindowsExplorer.exe
2764	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
2952	explorer.exe
1936	EdgeBrowser.exe
2856	realtekaudio.exe
2752	realtekaudio.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x00080000000139f4-60.dat	upx
behavioral1/files/0x00080000000139f4-62.dat	upx
behavioral1/memory/764-64-0x0000000000400000-0x00000000004AC000-memory.dmp	upx
behavioral1/memory/764-108-0x0000000000400000-0x00000000004AC000-memory.dmp	upx

Drops startup file 8 IoCs

Processes:

realtekaudio.exeWinExplorer.exeFirefoxinstaller.exeEdgeBrowser.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe	realtekaudio.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe	WinExplorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe	WinExplorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe	Firefoxinstaller.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe	Firefoxinstaller.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe	EdgeBrowser.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe	EdgeBrowser.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe	realtekaudio.exe

Loads dropped DLL 30 IoCs

Processes:

Firefoxinstaller.exeWerFault.exeWerFault.exeWinExplorer.exeFirefoxinstaller.exeFirefoxinstaller.execmd.exeEdgeBrowser.exeEasyAASM.exe

pid	Process
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2856	WinExplorer.exe
2856	WinExplorer.exe
1872	Firefoxinstaller.exe
2764	Firefoxinstaller.exe
2764	Firefoxinstaller.exe
2764	Firefoxinstaller.exe
2764	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
2712	cmd.exe
2712	cmd.exe
2864	EdgeBrowser.exe
2864	EdgeBrowser.exe
772	EasyAASM.exe
772	EasyAASM.exe
772	EasyAASM.exe

Windows security modification 2 TTPs 15 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

EdgeBrowser.exeFirefoxinstaller.exeWinExplorer.exerealtekaudio.exerealtekaudio.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\EdgeBrowser.exe = "0"	EdgeBrowser.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\Firefoxinstaller.exe = "0"	Firefoxinstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	WinExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	WinExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe = "0"	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe = "0"	EdgeBrowser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe = "0"	realtekaudio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe = "0"	Firefoxinstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\realtekaudio.exe = "0"	realtekaudio.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\WinExplorer.exe = "0"	WinExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	WinExplorer.exe

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WindowsExplorer.exeEdgeBrowser.exeWinExplorer.exeFirefoxinstaller.exeexplorer.exeEdgeBrowser.exerealtekaudio.exerealtekaudio.exeFirefoxinstaller.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\explorer\\explorer.exe\""	WindowsExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\EdgeBrowser.exe"	EdgeBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\Documents\\WinExplorer.exe"	WinExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\explorer\\explorer.exe\""	WindowsExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exeI nstaller\\Firefox.exe"	Firefoxinstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinExplorer.exe = "C:\\Users\\Admin\\Documents\\WinExplorer.exe"	WinExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\EdgeBrowser.exe = "C:\\Users\\Admin\\Documents\\EdgeBrowser.exe"	EdgeBrowser.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WindowsExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Roaming\\realtekaudio.exe"	realtekaudio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Roaming\\realtekaudio.exe"	realtekaudio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\Documents\\EdgeBrowser.exe"	EdgeBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Firefoxinstaller.exe = "C:\\Users\\Admin\\Documents\\Firefoxinstaller.exe"	Firefoxinstaller.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WindowsExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\explorer\\explorer.exe\""	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\explorer\\explorer.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\realtekaudio.exe = "C:\\Users\\Admin\\AppData\\Roaming\\realtekaudio.exe"	realtekaudio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\Documents\\Firefoxinstaller.exe"	Firefoxinstaller.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

WD+UAC.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WD+UAC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WD+UAC.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

WindowsExplorer.exeexplorer.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	WindowsExplorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	explorer.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/764-64-0x0000000000400000-0x00000000004AC000-memory.dmp	autoit_exe
behavioral1/memory/764-108-0x0000000000400000-0x00000000004AC000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

Processes:

WinExplorer.exeEdgeBrowser.exeFirefoxinstaller.exe

pid	Process
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

EdgeBrowser.exeWinExplorer.exeFirefoxinstaller.exeFirefoxinstaller.exe

description	pid	Process	procid_target
PID 748 set thread context of 2864	748	EdgeBrowser.exe	70
PID 1936 set thread context of 2856	1936	WinExplorer.exe	69
PID 1872 set thread context of 2764	1872	Firefoxinstaller.exe	84
PID 2764 set thread context of 2596	2764	Firefoxinstaller.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1740	1624	WerFault.exe	30
2808	760	WerFault.exe	31

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
832	schtasks.exe
4504	schtasks.exe

Delays execution with timeout.exe 6 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	Process
2796	timeout.exe
3060	timeout.exe
3836	timeout.exe
3848	timeout.exe
3888	timeout.exe
2748	timeout.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exe

pid	Process
1552	reg.exe
2628	reg.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

MicrosoftCompatibility Download.exeEdgeBrowser.exeWinExplorer.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	MicrosoftCompatibility Download.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	EdgeBrowser.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	MicrosoftCompatibility Download.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	MicrosoftCompatibility Download.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	WinExplorer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WinExplorer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WinExplorer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	MicrosoftCompatibility Download.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	EdgeBrowser.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2340	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

tmp429D.tmp.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWinExplorer.exeEdgeBrowser.exeWinExplorer.exepowershell.exeFirefoxinstaller.exepowershell.exepowershell.exeFirefoxinstaller.exepowershell.exepowershell.exepowershell.exe

pid	Process
1052	tmp429D.tmp.exe
1052	tmp429D.tmp.exe
1052	tmp429D.tmp.exe
1604	powershell.exe
1492	powershell.exe
1992	powershell.exe
1056	powershell.exe
960	powershell.exe
2044	powershell.exe
1816	powershell.exe
648	powershell.exe
1984	powershell.exe
908	powershell.exe
1916	powershell.exe
2012	powershell.exe
1936	WinExplorer.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
748	EdgeBrowser.exe
1936	WinExplorer.exe
1936	WinExplorer.exe
2856	WinExplorer.exe
2856	WinExplorer.exe
2856	WinExplorer.exe
2672	powershell.exe
1872	Firefoxinstaller.exe
2580	powershell.exe
1872	Firefoxinstaller.exe
1872	Firefoxinstaller.exe
2684	powershell.exe
2596	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
3044	powershell.exe
2600	powershell.exe
2980	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

tmp42EC.tmp.exe

pid	Process
764	tmp42EC.tmp.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exetmp429D.tmp.exeMicrosoftCompatibility Download.exeFirefoxinstaller.exeWinExplorer.exeEdgeBrowser.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWinExplorer.exepowershell.exepowershell.exepowershell.exeFirefoxinstaller.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe
Token: SeDebugPrivilege	1052	tmp429D.tmp.exe
Token: SeDebugPrivilege	760	MicrosoftCompatibility Download.exe
Token: SeDebugPrivilege	1872	Firefoxinstaller.exe
Token: SeDebugPrivilege	1936	WinExplorer.exe
Token: SeDebugPrivilege	748	EdgeBrowser.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2856	WinExplorer.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2596	Firefoxinstaller.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

tmp42EC.tmp.exe

pid	Process
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

tmp42EC.tmp.exe

pid	Process
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

tmp42EC.tmp.exeFirefoxinstaller.exeexplorer.exe

pid	Process
764	tmp42EC.tmp.exe
764	tmp42EC.tmp.exe
2596	Firefoxinstaller.exe
2596	Firefoxinstaller.exe
2952	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exetmp429D.tmp.exeWD+UAC.exeWinExplorer.exeFirefoxinstaller.exe

description	pid	Process	procid_target
PID 940 wrote to memory of 1052	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	28
PID 940 wrote to memory of 1052	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	28
PID 940 wrote to memory of 1052	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	28
PID 940 wrote to memory of 764	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	29
PID 940 wrote to memory of 764	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	29
PID 940 wrote to memory of 764	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	29
PID 940 wrote to memory of 764	940	deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe	29
PID 1052 wrote to memory of 1624	1052	tmp429D.tmp.exe	30
PID 1052 wrote to memory of 1624	1052	tmp429D.tmp.exe	30
PID 1052 wrote to memory of 1624	1052	tmp429D.tmp.exe	30
PID 1052 wrote to memory of 1624	1052	tmp429D.tmp.exe	30
PID 1052 wrote to memory of 760	1052	tmp429D.tmp.exe	31
PID 1052 wrote to memory of 760	1052	tmp429D.tmp.exe	31
PID 1052 wrote to memory of 760	1052	tmp429D.tmp.exe	31
PID 1052 wrote to memory of 760	1052	tmp429D.tmp.exe	31
PID 1052 wrote to memory of 772	1052	tmp429D.tmp.exe	32
PID 1052 wrote to memory of 772	1052	tmp429D.tmp.exe	32
PID 1052 wrote to memory of 772	1052	tmp429D.tmp.exe	32
PID 1052 wrote to memory of 772	1052	tmp429D.tmp.exe	32
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1872	1052	tmp429D.tmp.exe	33
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1448	1052	tmp429D.tmp.exe	34
PID 1052 wrote to memory of 1936	1052	tmp429D.tmp.exe	35
PID 1052 wrote to memory of 1936	1052	tmp429D.tmp.exe	35
PID 1052 wrote to memory of 1936	1052	tmp429D.tmp.exe	35
PID 1052 wrote to memory of 1936	1052	tmp429D.tmp.exe	35
PID 1052 wrote to memory of 748	1052	tmp429D.tmp.exe	36
PID 1052 wrote to memory of 748	1052	tmp429D.tmp.exe	36
PID 1052 wrote to memory of 748	1052	tmp429D.tmp.exe	36
PID 1052 wrote to memory of 748	1052	tmp429D.tmp.exe	36
PID 1624 wrote to memory of 1740	1624	WD+UAC.exe	37
PID 1624 wrote to memory of 1740	1624	WD+UAC.exe	37
PID 1624 wrote to memory of 1740	1624	WD+UAC.exe	37
PID 1624 wrote to memory of 1740	1624	WD+UAC.exe	37
PID 1936 wrote to memory of 1604	1936	WinExplorer.exe	38
PID 1936 wrote to memory of 1604	1936	WinExplorer.exe	38
PID 1936 wrote to memory of 1604	1936	WinExplorer.exe	38
PID 1936 wrote to memory of 1604	1936	WinExplorer.exe	38
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1872 wrote to memory of 1916	1872	Firefoxinstaller.exe	39
PID 1936 wrote to memory of 1984	1936	WinExplorer.exe	43
PID 1936 wrote to memory of 1984	1936	WinExplorer.exe	43
PID 1936 wrote to memory of 1984	1936	WinExplorer.exe	43
PID 1936 wrote to memory of 1984	1936	WinExplorer.exe	43
PID 1872 wrote to memory of 908	1872	Firefoxinstaller.exe	42
PID 1872 wrote to memory of 908	1872	Firefoxinstaller.exe	42
PID 1872 wrote to memory of 908	1872	Firefoxinstaller.exe	42
PID 1872 wrote to memory of 908	1872	Firefoxinstaller.exe	42

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

WD+UAC.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WD+UAC.exe

C:\Users\Admin\AppData\Local\Temp\deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe
"C:\Users\Admin\AppData\Local\Temp\deda52b25f9255b01eb0bb22444f6b8681e4a091da20c8c7d00efde1974c8025.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\tmp429D.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp429D.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\Documents\WD+UAC.exe
    "C:\Users\Admin\Documents\WD+UAC.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 620
      4⤵
      Loads dropped DLL
      Program crash
      PID:1740
- - C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe
    "C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1764
      4⤵
      Loads dropped DLL
      Program crash
      PID:2808
- - C:\Users\Admin\Documents\EasyAASM.exe
    "C:\Users\Admin\Documents\EasyAASM.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    PID:772
  - - C:\Windows\SysWOW64\reagentc.exe
      reagentc.exe /disable
      4⤵
      PID:2588
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2684
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2672
  - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
      "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
      4⤵
      Modifies WinLogon for persistence
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      PID:2856
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
        5⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\realtekaudio.exe" -Force
        5⤵
        
        PID:2176
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout 1
        5⤵
        
        PID:3784
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3848
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:188
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:596
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4400
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
      C:\Users\Admin\AppData\Roaming\realtekaudio.exe
      4⤵
      Windows security bypass
      Executes dropped EXE
      Drops startup file
      Windows security modification
      Adds Run key to start application
      PID:2752
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
        5⤵
        
        PID:2864
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\realtekaudio.exe" -Force
        5⤵
        
        PID:3228
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\realtekaudio.exe" -Force
        5⤵
        
        PID:3324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout 1
        5⤵
        
        PID:3772
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3836
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:816
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:308
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4264
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Roaming\realtekaudio.exe
        
        "C:\Users\Admin\AppData\Roaming\realtekaudio.exe"
        5⤵
        
        PID:6680
- - C:\Users\Admin\Documents\Firefoxinstaller.exe
    "C:\Users\Admin\Documents\Firefoxinstaller.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Windows security bypass
    - Executes dropped EXE
    - Drops startup file
    - Loads dropped DLL
    - Windows security modification
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:908
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\Firefoxinstaller.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:3024
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3060
  - - C:\Users\Admin\Documents\Firefoxinstaller.exe
      "C:\Users\Admin\Documents\Firefoxinstaller.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of SetThreadContext
      PID:2764
    - - C:\Users\Admin\Documents\Firefoxinstaller.exe
        
        "C:\Users\Admin\Documents\Firefoxinstaller.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2596
- - C:\Users\Admin\Documents\NortonInstaller.exe
    "C:\Users\Admin\Documents\NortonInstaller.exe"
    3⤵
    - Executes dropped EXE
    PID:1448
- - C:\Users\Admin\Documents\WinExplorer.exe
    "C:\Users\Admin\Documents\WinExplorer.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies Windows Defender Real-time Protection settings
    - Windows security bypass
    - Executes dropped EXE
    - Drops startup file
    - Windows security modification
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2012
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\WinExplorer.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:2720
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2748
  - - C:\Users\Admin\Documents\WinExplorer.exe
      "C:\Users\Admin\Documents\WinExplorer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2856
    - - C:\Users\Admin\Documents\WindowsExplorer.exe
        
        "C:\Users\Admin\Documents\WindowsExplorer.exe"
        5⤵
        Modifies WinLogon for persistence
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        
        PID:2804
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:900
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:1552
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
        6⤵
        Loads dropped DLL
        
        PID:2712
        
        C:\Windows\SysWOW64\PING.EXE
        
        PING 127.0.0.1 -n 2
        7⤵
        Runs ping.exe
        
        PID:2340
        
        C:\explorer\explorer.exe
        
        "C:\explorer\explorer.exe"
        7⤵
        Modifies WinLogon for persistence
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        UAC bypass
        Modifies registry key
        
        PID:2628
- - C:\Users\Admin\Documents\EdgeBrowser.exe
    "C:\Users\Admin\Documents\EdgeBrowser.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Windows security bypass
    - Executes dropped EXE
    - Drops startup file
    - Windows security modification
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:960
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1816
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:648
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\EdgeBrowser.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1492
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:2764
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2796
  - - C:\Users\Admin\Documents\EdgeBrowser.exe
      "C:\Users\Admin\Documents\EdgeBrowser.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2864
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn NYAN /F
        5⤵
        
        PID:2736
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn NYAN /tr "C:\Users\Admin\Documents\EdgeBrowser.exe" /sc minute /mo 1
        5⤵
        Creates scheduled task(s)
        
        PID:832
    - - C:\Users\Admin\EdgeBrowser.exe
        
        "C:\Users\Admin\EdgeBrowser.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1936
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
        6⤵
        
        PID:2188
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
        6⤵
        
        PID:3240
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force
        6⤵
        
        PID:3336
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\EdgeBrowser.exe" -Force
        6⤵
        
        PID:3444
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout 1
        6⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:3888
      - C:\Users\Admin\EdgeBrowser.exe
        
        "C:\Users\Admin\EdgeBrowser.exe"
        6⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn NYAN /F
        7⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn NYAN /tr "C:\Users\Admin\EdgeBrowser.exe" /sc minute /mo 1
        7⤵
        Creates scheduled task(s)
        
        PID:4504
- C:\Users\Admin\AppData\Local\Temp\tmp42EC.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp42EC.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfbc7d518bb43fcf72e5a9a976554a9f

SHA1
f3bcd8e00d91b7e6197440633514e39cc146ddd8

SHA256
00d624433f4a0b59e0aa01c5bccec9cd7a129815964e4421c5850b4e7ec0fb6d

SHA512
4620514cb960e354bed35dd7c84ab984307d40e18cc48eb0cbe8a50dea0ec28d9c0d5441a581e4570e6b05ba7d08ba78d9acabdc1b058eb9a0627344c361a06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bb4a57a6e8ea3b188fe0a0f81e4e875

SHA1
b1fc98c55341d5804bafa5fda2f09a500af9eb73

SHA256
f96acdb17d1eba5a9205b22463521c71aea67ae2570c9193c4beb50274e4abb8

SHA512
956fbaf4db57c089c491e6f722f0012f18e166649693dc2658c11070db05d318ec52ab5714bd70f18f56e2ce7cf80bbe923f7af25865418e53d0bef11faf5869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d30f052a3625bf9889c03f5722e6340

SHA1
7cff82165f40f5553f193931b7a7fd33def02e11

SHA256
a2de855583c2bc40f6a973c8677712ad6ca912ce48fcdb7f773e48b6be8abfa0

SHA512
ce37c4570ea344f9dc68b2ba47a03dd93e27b857bc7e8d345d62cc38bd36ea965ae6667917b91827a420a6b635d9bf3071a3a8c272878ce3a3da8f03fcd4f008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7b52ed3abcdb4cc1829478265012baa

SHA1
d91b17f13a3ae6640ca21b9da4e1722d9c1eb608

SHA256
883e0a7262c113839e7791a42c32443859796fd74e83724746caa506c819d97d

SHA512
6096e201dc1bcc2ac757e827a980ae8dc477e2b27926c6f19d57b24e2bf8d4f3de81ba36d1cabff08e251b2fa00c996d98e8d65ba1966998a7a2cd65e73109b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68267f218fae5d33aef7757b62cf74a5

SHA1
a6f86dbd8c11f8f6bb83b71c5080888925abd058

SHA256
348c2a5ab97ae421be015368d30fcbe8da5dc332936e7487fee37b509620a4e9

SHA512
a634462ef768bb754dc14187bfb65d2cfd3c1ee4dcb138697b60ba9fa18d76dd45d7564714057f14690b89b570a00c67d18f8bb0c6c3ae479f2d62914bffef51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a08c16dd251f6c3bf7538f657da7a90e

SHA1
5d2b6a877cedf65d82a5d494d9726ce8f3d153e1

SHA256
cf2374d754753045a5fbc237c29ddbeafdd4f54ff0c35cbe81961f2852a5b4c5

SHA512
507cf68990426c2aac9619e83992ba979c8017006aacb9f05173b9cfba0300b5aa9d7c74478d03153c1883ca8e4f28abf7012d5213efac6d4094a518a17a4675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71cd88fc37e6bcaeff46969bb759f207

SHA1
ed6026ab4c93031ac34d7972d87e51fac562aa5c

SHA256
c766d20e9ed02b704ebcffc95a04d4de47d0fc06a4d0e612ebccc07238e82ed9

SHA512
45675298082bdb91cb9915d8801b553c93741fcb81518c7c0790bd9d5213f745e7024a19a8cbb91a6b3ce362dc7e67adbce1046c7a9d0b217ab2759007b82c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp429D.tmp.exe

Filesize
1.3MB

MD5
11ee7471fc15a11b25135052aa282602

SHA1
bacf067665074dddd07b74c0ff44e27d549e6866

SHA256
7c85333ea420f466a6d3113f5ded4c3cadc8ba4d9ae92fe2f53d475543c8c87b

SHA512
391087e5eefd09f8013824ffdb7b2d5c27c41e259b56e19dbde061862276125dd6998468b71007503edad28e9d7cb5e88b15b9977a666a00194c3a6063e152d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp429D.tmp.exe

Filesize
1.3MB

MD5
11ee7471fc15a11b25135052aa282602

SHA1
bacf067665074dddd07b74c0ff44e27d549e6866

SHA256
7c85333ea420f466a6d3113f5ded4c3cadc8ba4d9ae92fe2f53d475543c8c87b

SHA512
391087e5eefd09f8013824ffdb7b2d5c27c41e259b56e19dbde061862276125dd6998468b71007503edad28e9d7cb5e88b15b9977a666a00194c3a6063e152d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42EC.tmp.exe

Filesize
479KB

MD5
ba9409e272ccd7bb5a43e9d28f1b7440

SHA1
2dd25abd0c6e55e05f596671c839ed035e00e61d

SHA256
73b7fea4754e8be18812adc0ddd7b3c3c8c3797a889cc801cc94c7195027aa11

SHA512
89a1e4e77465c965cfe9c1ab2983d601506469cafbebc327daeee52fefd319a4f988af375e932060a3debab5fea7ad7830ec8b0453daa08f7320358c54472bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42EC.tmp.exe

Filesize
479KB

MD5
ba9409e272ccd7bb5a43e9d28f1b7440

SHA1
2dd25abd0c6e55e05f596671c839ed035e00e61d

SHA256
73b7fea4754e8be18812adc0ddd7b3c3c8c3797a889cc801cc94c7195027aa11

SHA512
89a1e4e77465c965cfe9c1ab2983d601506469cafbebc327daeee52fefd319a4f988af375e932060a3debab5fea7ad7830ec8b0453daa08f7320358c54472bc9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c3b29703767dad79eaa77988b9e16965

SHA1
42b1a1c20bc7eb80d6218d321b9b1397ae6831af

SHA256
f3a1892903e26b7e2c5a78ea9e68faca1ef1b1705eb960b03567df5bf15e4ca1

SHA512
c3a4e590b6f0b3242469e5fed849c99563457ee3e943d83beb591bfabcabad28e698c4483c584a1b4c7994c6ff2c682e6a2929be5bed0213c2b71d9ab90028ef

Download Submit
C:\Users\Admin\Documents\EasyAASM.exe

Filesize
315KB

MD5
4807d6b3bc3740ed58861f208470d076

SHA1
5efe5de43d28aeaa24c7065ce7113fd0c96f2539

SHA256
133a86c10b14d53d0807901d3cd477b0e1f62b9351707fe82ded7fe19c1f7689

SHA512
e1494471bc8bf182b694907714043cc39d7e4003ccfd56d1fc41c3d15071bf2cc4347858afacff174849be30b32aab828f91d13f3dd58629e0f560918bca6475

Download Submit
C:\Users\Admin\Documents\EasyAASM.exe

Filesize
315KB

MD5
4807d6b3bc3740ed58861f208470d076

SHA1
5efe5de43d28aeaa24c7065ce7113fd0c96f2539

SHA256
133a86c10b14d53d0807901d3cd477b0e1f62b9351707fe82ded7fe19c1f7689

SHA512
e1494471bc8bf182b694907714043cc39d7e4003ccfd56d1fc41c3d15071bf2cc4347858afacff174849be30b32aab828f91d13f3dd58629e0f560918bca6475

Download Submit
C:\Users\Admin\Documents\EdgeBrowser.exe

Filesize
1.3MB

MD5
824438344c636fdd81ff2e0d02577912

SHA1
ae288a2cc5bd0cce01615d8d568031c3e84902e2

SHA256
eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65

SHA512
09f1903c6244af5f191e64e9ff6025af6a1c752096b48d43094e5eb6f92c00a77381b49dd6d0d57fc995d4bc4a8375f0ef13d2a9cbc823e3d91b6b9f418b568b

Download Submit
C:\Users\Admin\Documents\EdgeBrowser.exe

Filesize
1.3MB

MD5
824438344c636fdd81ff2e0d02577912

SHA1
ae288a2cc5bd0cce01615d8d568031c3e84902e2

SHA256
eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65

SHA512
09f1903c6244af5f191e64e9ff6025af6a1c752096b48d43094e5eb6f92c00a77381b49dd6d0d57fc995d4bc4a8375f0ef13d2a9cbc823e3d91b6b9f418b568b

Download Submit
C:\Users\Admin\Documents\EdgeBrowser.exe

Filesize
1.3MB

MD5
824438344c636fdd81ff2e0d02577912

SHA1
ae288a2cc5bd0cce01615d8d568031c3e84902e2

SHA256
eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65

SHA512
09f1903c6244af5f191e64e9ff6025af6a1c752096b48d43094e5eb6f92c00a77381b49dd6d0d57fc995d4bc4a8375f0ef13d2a9cbc823e3d91b6b9f418b568b

Download Submit
C:\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
C:\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
C:\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
C:\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
C:\Users\Admin\Documents\NortonInstaller.exe

Filesize
2.1MB

MD5
d2fe1a2f73303d37c178250add341b97

SHA1
e341e8adaec629d299101bbf1b9a3ca2bfaf7417

SHA256
26742bef88539fcb6beb9753293a4fef4044663cfcb0a799e989194fcdfd3456

SHA512
0c685c265ed28f7655bf27c1a5c1f735670df40ae6e4b835bac3cc62b63b8fe54af82ab0941ca988b1c3220e740c0b2508103a1736b72a79a27ea17bf9a1bc81

Download Submit
C:\Users\Admin\Documents\NortonInstaller.exe

Filesize
2.1MB

MD5
d2fe1a2f73303d37c178250add341b97

SHA1
e341e8adaec629d299101bbf1b9a3ca2bfaf7417

SHA256
26742bef88539fcb6beb9753293a4fef4044663cfcb0a799e989194fcdfd3456

SHA512
0c685c265ed28f7655bf27c1a5c1f735670df40ae6e4b835bac3cc62b63b8fe54af82ab0941ca988b1c3220e740c0b2508103a1736b72a79a27ea17bf9a1bc81

Download Submit
C:\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
C:\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
C:\Users\Admin\Documents\WinExplorer.exe

Filesize
1.0MB

MD5
3830fb01bdf4b41e2e9551d422caf795

SHA1
d63a892fc41d2be82de8d02a04b906a8595dcac9

SHA256
6c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422

SHA512
5f2c54bd05b2fe4109b66e3721a19cd533899c3c694ca3a51422cb5d4015d536b96d0e16ea1f5ed8a43dc6d3e690a1702351034f3a68765d6dc6b16983c19886

Download Submit
C:\Users\Admin\Documents\WinExplorer.exe

Filesize
1.0MB

MD5
3830fb01bdf4b41e2e9551d422caf795

SHA1
d63a892fc41d2be82de8d02a04b906a8595dcac9

SHA256
6c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422

SHA512
5f2c54bd05b2fe4109b66e3721a19cd533899c3c694ca3a51422cb5d4015d536b96d0e16ea1f5ed8a43dc6d3e690a1702351034f3a68765d6dc6b16983c19886

Download Submit
C:\Users\Admin\Documents\WinExplorer.exe

Filesize
1.0MB

MD5
3830fb01bdf4b41e2e9551d422caf795

SHA1
d63a892fc41d2be82de8d02a04b906a8595dcac9

SHA256
6c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422

SHA512
5f2c54bd05b2fe4109b66e3721a19cd533899c3c694ca3a51422cb5d4015d536b96d0e16ea1f5ed8a43dc6d3e690a1702351034f3a68765d6dc6b16983c19886

Download Submit
C:\Users\Admin\Documents\WindowsExplorer.exe

Filesize
92KB

MD5
01ccde20287004986c0f29ff0df2e3b1

SHA1
18f9831e3246a08f000b0f4d6f009f2294c7c652

SHA256
862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860

SHA512
785545dcb74ca29b405261931be0464e65aadc84ebf51e7ad62af709b3867c3a706c9b4efc1e7f922e90c301ff0944feb2dbe6a790db7ac0ba4215b75fde86ee

Download Submit
C:\Users\Admin\Documents\WindowsExplorer.exe

Filesize
92KB

MD5
01ccde20287004986c0f29ff0df2e3b1

SHA1
18f9831e3246a08f000b0f4d6f009f2294c7c652

SHA256
862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860

SHA512
785545dcb74ca29b405261931be0464e65aadc84ebf51e7ad62af709b3867c3a706c9b4efc1e7f922e90c301ff0944feb2dbe6a790db7ac0ba4215b75fde86ee

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
\Users\Admin\Documents\Firefoxinstaller.exe

Filesize
1.5MB

MD5
70d3bb5c6ca4166d190ad265b14f117e

SHA1
95497e892ee875ef226edf3db059121c2c5284ed

SHA256
7d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9

SHA512
0abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720

Download Submit
\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
\Users\Admin\Documents\MicrosoftCompatibility Download.exe

Filesize
29KB

MD5
cc4dacf8520e38549ad23aaeedf67027

SHA1
2583bf30caee94ea804201c65d55d6e4df7f643f

SHA256
671d6806eb42b720d6fd9aa0e19c14918bb79204db90b5db1fbdf67ee87c253f

SHA512
4e8ad8b28d596c9844d5255e9f25f3e9999433e8804e1eb2af2bf3a1aba2742c1a4df500b460c5837f596f41f0d3f05686c5d817de6b294edbae1a652c63725a

Download Submit
\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
\Users\Admin\Documents\WD+UAC.exe

Filesize
97KB

MD5
a77ff55010a30b7bda46c35f74c160ea

SHA1
2be0031a06e02ce9a16ffd59747e793314759167

SHA256
7a2b062cfbd490970999dff5b19a25b0600d6ada1cf1271066dcf335d74dee30

SHA512
fdd0e51697aa2bcea5ae6939493cc5360794f96429e08d194ac1b72b689221da047bae8be0f698654b42e23f5381b102b0854e1cece20557df93db1c596eed02

Download Submit
\Users\Admin\Documents\WindowsExplorer.exe

Filesize
92KB

MD5
01ccde20287004986c0f29ff0df2e3b1

SHA1
18f9831e3246a08f000b0f4d6f009f2294c7c652

SHA256
862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860

SHA512
785545dcb74ca29b405261931be0464e65aadc84ebf51e7ad62af709b3867c3a706c9b4efc1e7f922e90c301ff0944feb2dbe6a790db7ac0ba4215b75fde86ee

Download Submit
\Users\Admin\Documents\WindowsExplorer.exe

Filesize
92KB

MD5
01ccde20287004986c0f29ff0df2e3b1

SHA1
18f9831e3246a08f000b0f4d6f009f2294c7c652

SHA256
862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860

SHA512
785545dcb74ca29b405261931be0464e65aadc84ebf51e7ad62af709b3867c3a706c9b4efc1e7f922e90c301ff0944feb2dbe6a790db7ac0ba4215b75fde86ee

Download Submit
memory/648-123-0x0000000000000000-mapping.dmp

Download
memory/648-153-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/648-214-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/748-90-0x0000000000000000-mapping.dmp

Download
memory/748-94-0x0000000000AD0000-0x0000000000C16000-memory.dmp

Filesize
1.3MB

Download
memory/748-107-0x00000000004B0000-0x00000000004E6000-memory.dmp

Filesize
216KB

Download
memory/760-69-0x0000000000000000-mapping.dmp

Download
memory/760-97-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/764-61-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/764-108-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/764-64-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/764-59-0x0000000000000000-mapping.dmp

Download
memory/772-231-0x0000000004A25000-0x0000000004A36000-memory.dmp

Filesize
68KB

Download
memory/772-72-0x0000000000000000-mapping.dmp

Download
memory/772-203-0x00000000050D0000-0x00000000051E4000-memory.dmp

Filesize
1.1MB

Download
memory/772-99-0x0000000000AE0000-0x0000000000B36000-memory.dmp

Filesize
344KB

Download
memory/832-246-0x0000000000000000-mapping.dmp

Download
memory/900-252-0x0000000000000000-mapping.dmp

Download
memory/908-151-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/908-212-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/908-119-0x0000000000000000-mapping.dmp

Download
memory/940-54-0x000007FEF39D0000-0x000007FEF43F3000-memory.dmp

Filesize
10.1MB

Download
memory/940-55-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Filesize
8KB

Download
memory/960-120-0x0000000000000000-mapping.dmp

Download
memory/960-220-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/960-159-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1052-74-0x000000001B216000-0x000000001B235000-memory.dmp

Filesize
124KB

Download
memory/1052-63-0x0000000000B00000-0x0000000000C48000-memory.dmp

Filesize
1.3MB

Download
memory/1052-56-0x0000000000000000-mapping.dmp

Download
memory/1052-93-0x000000001B216000-0x000000001B235000-memory.dmp

Filesize
124KB

Download
memory/1056-131-0x0000000000000000-mapping.dmp

Download
memory/1056-215-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1056-154-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1448-80-0x0000000000000000-mapping.dmp

Download
memory/1492-129-0x0000000000000000-mapping.dmp

Download
memory/1492-216-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-155-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1552-261-0x0000000000000000-mapping.dmp

Download
memory/1604-114-0x0000000000000000-mapping.dmp

Download
memory/1604-158-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1604-219-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1624-100-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1624-95-0x0000000000820000-0x0000000000842000-memory.dmp

Filesize
136KB

Download
memory/1624-66-0x0000000000000000-mapping.dmp

Download
memory/1740-109-0x0000000000000000-mapping.dmp

Download
memory/1816-210-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1816-121-0x0000000000000000-mapping.dmp

Download
memory/1816-149-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1872-105-0x0000000000670000-0x00000000006B0000-memory.dmp

Filesize
256KB

Download
memory/1872-98-0x0000000000FF0000-0x0000000001180000-memory.dmp

Filesize
1.6MB

Download
memory/1872-76-0x0000000000000000-mapping.dmp

Download
memory/1916-209-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-115-0x0000000000000000-mapping.dmp

Download
memory/1916-148-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-287-0x0000000000000000-mapping.dmp

Download
memory/1936-87-0x0000000000000000-mapping.dmp

Download
memory/1936-290-0x0000000001080000-0x00000000011C6000-memory.dmp

Filesize
1.3MB

Download
memory/1936-103-0x0000000000360000-0x000000000038E000-memory.dmp

Filesize
184KB

Download
memory/1936-96-0x0000000000B20000-0x0000000000C2C000-memory.dmp

Filesize
1.0MB

Download
memory/1984-118-0x0000000000000000-mapping.dmp

Download
memory/1984-150-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-211-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-156-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-217-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-134-0x0000000000000000-mapping.dmp

Download
memory/2012-152-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-213-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-122-0x0000000000000000-mapping.dmp

Download
memory/2044-157-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2044-125-0x0000000000000000-mapping.dmp

Download
memory/2044-218-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2176-307-0x0000000000000000-mapping.dmp

Download
memory/2176-328-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2188-305-0x0000000000000000-mapping.dmp

Download
memory/2188-329-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2212-325-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2212-302-0x0000000000000000-mapping.dmp

Download
memory/2340-265-0x0000000000000000-mapping.dmp

Download
memory/2564-288-0x0000000000000000-mapping.dmp

Download
memory/2580-241-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2580-223-0x0000000000000000-mapping.dmp

Download
memory/2580-283-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2588-222-0x0000000000000000-mapping.dmp

Download
memory/2596-280-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-274-0x000000000041768E-mapping.dmp

Download
memory/2596-268-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-267-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2600-298-0x0000000000000000-mapping.dmp

Download
memory/2600-320-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2628-289-0x0000000000000000-mapping.dmp

Download
memory/2672-284-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-242-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-224-0x0000000000000000-mapping.dmp

Download
memory/2684-286-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2684-281-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2684-225-0x0000000000000000-mapping.dmp

Download
memory/2712-260-0x0000000000000000-mapping.dmp

Download
memory/2720-169-0x0000000000000000-mapping.dmp

Download
memory/2736-227-0x0000000000000000-mapping.dmp

Download
memory/2748-170-0x0000000000000000-mapping.dmp

Download
memory/2752-292-0x0000000000000000-mapping.dmp

Download
memory/2752-295-0x0000000000500000-0x0000000000530000-memory.dmp

Filesize
192KB

Download
memory/2764-249-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2764-257-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2764-254-0x000000000042063E-mapping.dmp

Download
memory/2764-259-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2764-171-0x0000000000000000-mapping.dmp

Download
memory/2764-251-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2764-250-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2764-266-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/2764-247-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2764-245-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2796-172-0x0000000000000000-mapping.dmp

Download
memory/2804-230-0x0000000000000000-mapping.dmp

Download
memory/2808-173-0x0000000000000000-mapping.dmp

Download
memory/2856-188-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-291-0x0000000000000000-mapping.dmp

Download
memory/2856-221-0x0000000002235000-0x0000000002246000-memory.dmp

Filesize
68KB

Download
memory/2856-202-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-200-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-194-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-195-0x000000000040D9BE-mapping.dmp

Download
memory/2856-191-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-180-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-183-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-293-0x0000000000390000-0x00000000004A4000-memory.dmp

Filesize
1.1MB

Download
memory/2864-306-0x0000000000000000-mapping.dmp

Download
memory/2864-326-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2864-199-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-193-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-184-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-187-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-181-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-179-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-186-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2864-189-0x0000000000414EBE-mapping.dmp

Download
memory/2952-282-0x0000000000000000-mapping.dmp

Download
memory/2980-299-0x0000000000000000-mapping.dmp

Download
memory/2980-321-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/3024-204-0x0000000000000000-mapping.dmp

Download
memory/3044-297-0x0000000000000000-mapping.dmp

Download
memory/3044-319-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-207-0x0000000000000000-mapping.dmp

Download
memory/3228-330-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/3228-310-0x0000000000000000-mapping.dmp

Download
memory/3240-327-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/3240-311-0x0000000000000000-mapping.dmp

Download
memory/3324-313-0x0000000000000000-mapping.dmp

Download
memory/3336-314-0x0000000000000000-mapping.dmp

Download
memory/3336-331-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/3444-318-0x0000000000000000-mapping.dmp

Download
memory/3444-332-0x000000006D580000-0x000000006DB2B000-memory.dmp

Filesize
5.7MB

Download
memory/3772-333-0x0000000000000000-mapping.dmp

Download
memory/3784-334-0x0000000000000000-mapping.dmp

Download